radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in     r_read_le32 in libr/include/r_endian.h. (CVE-2023-47016)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1077 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-46569:
    An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of     libr/arch/p/nds32/nds32-dis.h.

    CVE-2023-46570:
    An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of     libr/arch/p/nds32/nds32-dis.h.

    CVE-2023-47016:
    radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in     r_read_le32 in libr/include/r_endian.h.

    CVE-2023-5686:
    Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.

    CVE-2024-29645:
    Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via     the parse_die function.

    CVE-2024-29646:
    Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via     the name, type, or group fields.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-a562addefa advisory.

    Bump to version 5.9.4

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-3667e29b88 advisory.

    Bump to version 5.9.4

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250484	Linux Distros Unpatched Vulnerability : CVE-2023-47016	Nessus	Misc.	high
238656	TencentOS Server 4: radare2 (TSSA-2024:1077)	Nessus	Tencent Local Security Checks	critical
206144	Fedora 40 : iaito / radare2 (2024-a562addefa)	Nessus	Fedora Local Security Checks	high
206143	Fedora 39 : iaito / radare2 (2024-3667e29b88)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2023-47016

high

Tenable Plugins

high

critical

high

high