CVE-2019-14745

In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c

published August 7, 2019

CVSS
—
EPSS
4%
Percentile
91.4
In the wild
Unconfirmed
What it is

In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04451 · 91.4th percentile
Published
2019-08-07T14:58Z
EPSS history
Timeline
  • 07 AUG 14:58Z
    In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c
    cvelistv5