CVE-2017-16805

Name	CVE-2017-16805
Description	In radare2 2.0.1, libr/bin/dwarf.c allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file, related to r_bin_dwarf_parse_comp_unit in dwarf.c and sdb_set_internal in shlr/sdb/src/sdb.c.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	882134

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
radare2 (PTS)	sid	6.0.4+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
radare2	source	wheezy	(not affected)
radare2	source	(unstable)	2.1.0+dfsg-1			882134

Notes

[jessie] - radare2 <no-dsa> (Minor issue)
[wheezy] - radare2 <not-affected> (Vulnerable code does not exist; no dwarf support)
https://github.com/radare/radare2/commit/2ca9ab45891b6ae8e32b6c28c81eebca059cbe5d
https://github.com/radare/radare2/issues/8813