VDB

CVE-2018-20459

CVE-2018-20459 PUBLISHED CVSS 5.5 MEDIUM

In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-of-service (application crash by out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20457.

EPSS 0.93% · 58.3th percentile

Risk Scores

CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score
0.93%
58.3th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSradare20.9.6-3.1ubuntu1, 0
Ubuntu:Pro:24.04:LTSradare25.5.0+dfsg-1.1ubuntu3+esm1, 0, 5.5.0+dfsg-1ubuntu1
Ubuntu:Pro:18.04:LTSradare22.3.0+dfsg-2ubuntu0.1~esm1, 0, 1.6.0+dfsg-1
Ubuntu:25.10radare25.9.8+dfsg-2, 0, *

Timeline

  • Dec 25, 2018 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 25, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Dec 28, 2021 EPSS Score
  • Mar 1, 2022 EPSS Score
  • May 3, 2022 EPSS Score
  • May 13, 2022 CVE Updated
  • Jul 5, 2022 EPSS Score
  • Nov 8, 2022 EPSS Score
  • Jan 10, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›