Source: radare2 Version: 1.1.0+dfsg-5 Severity: important Tags: security upstream patch Forwarded: https://github.com/radare/radare2/issues/7698
Hi, the following vulnerability was published for radare2. CVE-2017-9520[0]: | The r_config_set function in libr/config/config.c in radare2 1.5.0 | allows remote attackers to cause a denial of service (use-after-free | and application crash) via a crafted DEX file. >From trying to follow the code it looks present in 1.1.0 as well, but please confirm if I'm wrong. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2017-9520 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9520 [1] https://github.com/radare/radare2/issues/7698 [2] https://github.com/radare/radare2/commit/f85bc674b2a2256a364fe796351bc1971e106005 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
