Source: radare2 Version: 1.1.0+dfsg-1 Severity: important Tags: patch security upstream Forwarded: https://github.com/radare/radare2/issues/8742
Hi, the following vulnerability was published for radare2. CVE-2017-16357[0]: | In radare 2.0.1, a memory corruption vulnerability exists in | store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in | libr/bin/format/elf/elf.c, as demonstrated by an invalid free. This | error is due to improper sh_size validation when allocating memory. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2017-16357 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16357 [1] https://github.com/radare/radare2/issues/8742 [2] https://github.com/radare/radare2/commit/0b973e28166636e0ff1fad80baa0385c9c09c53a Regards, Salvatore _______________________________________________ Secure-testing-team mailing list Secure-testing-team@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-team
