Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 903151 (CVE-2023-1605, CVE-2023-27114) - <dev-util/radare2-5.8.6: multiple DoS vulnerabilities
Summary: <dev-util/radare2-5.8.6: multiple DoS vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2023-1605, CVE-2023-27114
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL: https://huntr.dev/bounties/9dddcf5b-7...
Whiteboard: ~3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2023-03-27 02:49 UTC by John Helmert III
Modified: 2023-06-12 04:40 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-03-27 02:49:01 UTC 
CVE-2023-1605:

Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.

Patch: https://github.com/radareorg/radare2/commit/508a6307045441defd1bef0999a1f7052097613f

Commit not actually in 5.8.6.
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-04-29 20:40:49 UTC 
CVE-2023-27114 (https://github.com/radareorg/radare2/issues/21363):

radare2 v5.8.3 was discovered to contain a segmentation fault via the component wasm_dis at p/wasm/wasm.c.

Fix is in 5.8.4: https://github.com/radareorg/radare2/commit/a15067a8eaa836bcc24b0882712c14d1baa66509
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-05-30 03:24:37 UTC 
(In reply to John Helmert III from comment #0)
> CVE-2023-1605:
> 
> Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.
> 
> Patch:
> https://github.com/radareorg/radare2/commit/
> 508a6307045441defd1bef0999a1f7052097613f
> 
> Commit not actually in 5.8.6.

... now it is! And 5.8.6 is in the tree.
Comment 3 Larry the Git Cow gentoo-dev 2023-06-09 04:43:50 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dd0ec87d6d8984f7c89de21f735f487d331ab8ac

commit dd0ec87d6d8984f7c89de21f735f487d331ab8ac
Author:     John Helmert III <ajak@gentoo.org>
AuthorDate: 2023-06-09 04:43:27 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2023-06-09 04:43:42 +0000

    dev-util/radare2: drop 5.8.2
    
    Bug: https://bugs.gentoo.org/903151
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 dev-util/radare2/Manifest             |   5 --
 dev-util/radare2/radare2-5.8.2.ebuild | 125 ----------------------------------
 2 files changed, 130 deletions(-)