CVE-2017-9761

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The find_eoq function in libr/core/cmd.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/99138Third Party Advisory, VDB Entry
https://github.com/radare/radare2/commit/00e8f205475332d7842d0f0d1481eeab4e83017cIssue Tracking, Patch, Third Party Advisory
https://github.com/radare/radare2/issues/7727Issue Tracking, Patch, Third Party Advisory
http://www.securityfocus.com/bid/99138Third Party Advisory, VDB Entry
https://github.com/radare/radare2/commit/00e8f205475332d7842d0f0d1481eeab4e83017cIssue Tracking, Patch, Third Party Advisory
https://github.com/radare/radare2/issues/7727Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jun 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-97625.5The cmd_info function in libr/core/cmd_info.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and appl CVE-2017-97637.5The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote CVE-2017-97646.1Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP CVE-2017-97658.1Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows CVE-2017-97667.5In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in CVE-2017-97675.4Multiple cross-site scripting (XSS) vulnerabilities in Quali CloudShell before 8 allow remote authenticated users to inject arbitrary web sc CVE-2017-97699.8A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a CVE-2017-97705.5A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse that can cause an out of bounds read operation to occur due CVE-2017-97719.8install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or CVE-2017-97729.8Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in bina CVE-2017-97735.7Denial of Service was found in Horde_Image 2.x before 2.5.0 via a crafted URL to the "Null" image driver.CVE-2017-97748.8Remote Code Execution was found in Horde_Image 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication.