Bug 1723353 (CVE-2019-12790) - CVE-2019-12790 radare2: heap-based buffer over-read in function r_egg_lang_parsechar in egg_lang.c
Summary: CVE-2019-12790 radare2: heap-based buffer over-read in function r_egg_lang_pa...
Keywords:
Status: CLOSED UPSTREAM
Alias: CVE-2019-12790
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1723354 1723356
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-06-24 11:01 UTC by Dhananjay Arunesh
Modified: 2019-09-29 15:15 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2019-07-12 13:08:00 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2019-06-24 11:01:14 UTC 
In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because of missing length validation in libr/egg/egg.c.

Reference:
https://github.com/radare/radare2/issues/14211
Comment 1 Dhananjay Arunesh 2019-06-24 11:01:49 UTC 
Created radare2 tracking bugs for this issue:

Affects: fedora-all [bug 1723354]
Comment 2 Dhananjay Arunesh 2019-06-24 11:02:09 UTC 
Created radare2 tracking bugs for this issue:

Affects: epel-7 [bug 1723356]
Comment 3 Riccardo Schirone 2019-06-27 10:56:21 UTC 
Upstream patch:
https://github.com/radare/radare2/commit/e710401ebb4a892a87b0c709d709af8b5dcbbb01
Comment 4 Product Security DevOps Team 2019-07-12 13:08:00 UTC 
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.
Note You need to log in before you can comment on or make changes to this bug.