Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to     5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.
    (CVE-2022-1296)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This
    vulnerability is heap overflow and may be exploitable. For more general description of heap buffer
    overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html). (CVE-2022-1238)

  - Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8.
    (CVE-2022-1061)

  - Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows
    attackers to read sensitive information from outside the allocated buffer boundary. (CVE-2022-1207)

  - Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8. This
    vulnerability is heap overflow and may be exploitable. For more general description of heap buffer
    overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html). (CVE-2022-1237)

ID	Name	Product	Family	Severity
257692	Linux Distros Unpatched Vulnerability : CVE-2022-1296	Nessus	Misc.	critical
406887	Alpine: multiple radare2 packages: security update to 5.6.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
406887	Alpine: multiple radare2 packages: security update to 5.6.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical

Detections

Analytics

CVE-2022-1296

critical

Tenable Plugins

critical

critical

critical