Bug 27751 - radre2 security issue CVE-2020-15121
Summary: radre2 security issue CVE-2020-15121
Status: RESOLVED DUPLICATE of bug 27060
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Mageia Bug Squad
QA Contact: Sec team
URL: https://nvd.nist.gov/vuln/detail/CVE-...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-12-05 15:18 CET by Zombie Ryushu
Modified: 2020-12-05 15:45 CET (History)
0 users

See Also:
Source RPM: radare2-4.5.0-1.mga8.src
CVE: CVE-2020-15121
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Zombie Ryushu 2020-12-05 15:18:39 CET 
In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current directory.
Zombie Ryushu 2020-12-05 15:19:00 CET

CVE: (none) => CVE-2020-15121

Comment 1 David Walser 2020-12-05 15:45:25 CET 
Already reported and fixed.

*** This bug has been marked as a duplicate of bug 27060 ***

Status: NEW => RESOLVED
Resolution: (none) => DUPLICATE
Note You need to log in before you can comment on or make changes to this bug.