CVE-2017-6415 — MEDIUM (5.5)

Vulnerability Description

The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DEX file.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Radare	Radare2	1.2.1

Related Weaknesses (CWE)

CWE-476

References

http://www.securityfocus.com/bid/96523Third Party AdvisoryVDB Entry
https://github.com/radare/radare2/issues/6872Issue TrackingPatchThird Party Advisory
https://github.com/radareorg/radare2/commit/68338b71a563b24e62617bb629059adc0c94PatchVendor Advisory
http://www.securityfocus.com/bid/96523Third Party AdvisoryVDB Entry
https://github.com/radare/radare2/issues/6872Issue TrackingPatchThird Party Advisory
https://github.com/radareorg/radare2/commit/68338b71a563b24e62617bb629059adc0c94PatchVendor Advisory

FAQ

What is CVE-2017-6415?

CVE-2017-6415 is a vulnerability with a CVSS score of 5.5 (MEDIUM). The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DEX file.

How severe is CVE-2017-6415?

CVE-2017-6415 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-6415?

Check the references section above for vendor advisories and patch information. Affected products include: Radare Radare2.