CVE-2019-14745

Name	CVE-2019-14745
Description	In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	934204

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
radare2 (PTS)	sid, trixie	5.9.4+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
radare2	source	(unstable)	3.9.0+dfsg-1			934204

Notes

[jessie] - radare2 <no-dsa> (Minor issue)
https://github.com/radare/radare2/pull/14690
When fixing this ussue make sure to not only apply the initial commits but
as well the followups to avoid opening CVE-2019-16718:
https://github.com/radareorg/radare2/commit/5411543a310a470b1257fb93273cdd6e8dfcb3af
https://github.com/radareorg/radare2/commit/dd739f5a45b3af3d1f65f00fe19af1dbfec7aea7