Fedora has issued an advisory on November 9: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GFYOSKZAUGT7XKZWLV56ZMYJVZ6EHY42/ Fix: https://github.com/radareorg/radare2/commit/b2a467cd13c561042554901313ebdcb749eb0de7
Status comment: (none) => Patch available from upstreamVersion: Cauldron => 9Source RPM: (none) => radare2-5.8.8-1.2.mga9.src.rpmCVE: (none) => CVE-2024-48241
Cauldron is well in advance of M9, for which the given patch (thanks Nicolas for same). Assigning directly to DavidG who did almost all recent updates.
Assignee: bugsquad => geiger.david68210
Suggested advisory: ======================== The updated packages fix a security vulnerability: An issue in radare2 v5.8.0 through v5.9.4 allows a local attacker to cause a denial of service via the __bf_div function. (CVE-2024-48241) References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GFYOSKZAUGT7XKZWLV56ZMYJVZ6EHY42/ ======================== Updated packages in core/updates_testing: ======================== lib(64)radare2_5.8.8-5.8.8-1.3.mga9 lib(64)radare2-devel-5.8.8-1.3.mga9 radare2-5.8.8-1.3.mga9 from SRPM: radare2-5.8.8-1.3.mga9.src.rpm
Assignee: geiger.david68210 => qa-bugsStatus: NEW => ASSIGNEDStatus comment: Patch available from upstream => (none)
Keywords: (none) => advisory
RH x86_64 LC_ALL=C urpmi --auto --auto-update adding 3 new rpms not available in existing hdlist replacing /var/cache/urpmi/partial/synthesis.hdlist.cz with synthesis.hdlist.cz.tmp updating /var/cache/urpmi/partial/MD5SUM updated medium "QA Testing (64-bit)" medium "Core Release (distrib1)" is up-to-date medium "Core Updates (distrib3)" is up-to-date medium "Nonfree Release (distrib11)" is up-to-date medium "Nonfree Updates (distrib13)" is up-to-date medium "Tainted Release (distrib21)" is up-to-date medium "Tainted Updates (distrib23)" is up-to-date medium "Core 32bit Release (distrib31)" is up-to-date medium "Core 32bit Updates (distrib32)" is up-to-date medium "Nonfree 32bit Release (distrib36)" is up-to-date medium "Nonfree 32bit Updates (distrib37)" is up-to-date medium "Tainted 32bit Release (distrib41)" is up-to-date medium "Tainted 32bit Updates (distrib42)" is up-to-date installing radare2-5.8.8-1.3.mga9.x86_64.rpm lib64radare2_5.8.8-5.8.8-1.3.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64 Preparing... ################################################################################################## 1/2: lib64radare2_5.8.8 ################################################################################################## 2/2: radare2 ################################################################################################## 1/2: removing radare2-5.8.8-1.2.mga9.x86_64 ################################################################################################## 2/2: removing lib64radare2_5.8.8-5.8.8-1.2.mga9.x86_64 ################################################################################################## Reference bug#32521 comment#7 / Bug#33534 comment#3 rabin2 -I "/home/katnatek/windows/Program Files (x86)/K-Lite Codec Pack/MPC-HC64/mpc-hc64.exe" arch x86 baddr 0x140000000 binsz 9022976 bintype pe bits 64 canary true retguard false class PE32+ cmp.csum 0x008a22c3 compiled Thu Nov 29 16:00:08 2018 crypto false endian little havecode true hdr.csum 0x008a22c3 laddr 0x0 lang c linenum false lsyms false machine AMD 64 nx true os windows overlay false cc ms pic true relocs false signed false sanitize false static false stripped false subsys Windows GUI va true radare2 "/home/katnatek/windows/Program Files (x86)/K-Lite Codec Pack/MPC-HC64/mpc-hc64.exe" [0x14050380c]> aa INFO: Analyze all flags starting with sym. and entry0 (aa) INFO: Analyze all functions arguments/locals (afva@@@F) [0x14050380c]> s/ mpc Searching 3 bytes in [0x1408ef400-0x1408f0000] hits: 0 Searching 3 bytes in [0x1408d2000-0x1408ef400] hits: 0 Searching 3 bytes in [0x1408d1c00-0x1408d2000] hits: 0 Searching 3 bytes in [0x14084c000-0x1408d1c00] [# ]0x140882d8f hit0_0 . <!-- The mpchc_np id is used. Reference bug#29163 comment#18 / bug#32521 comment#8 rafind2 -s "text" /bin/kwrite | wc -l 1 r2 -a x86 /bin/oowriter [0x00000000]> V command output is the described cutter not installed this time
CC: (none) => andrewsfarmWhiteboard: (none) => MGA9-64-OK
Validating.
CC: (none) => sysadmin-bugsKeywords: (none) => validated_update
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2024-0367.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED