CVE-2019-16718

In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c

published September 23, 2019

CVSS
—
EPSS
2%
Percentile
83.2
In the wild
Unconfirmed
What it is

In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02300 · 83.2th percentile
Published
2019-09-23T13:18Z
EPSS history
Timeline
  • 23 SEP 13:18Z
    In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c
    cvelistv5