{"id":"CVE-2017-9520","details":"The r_config_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted DEX file.","modified":"2026-04-11T03:11:37.714893Z","published":"2017-06-08T14:29:00.297Z","references":[{"type":"REPORT","url":"https://github.com/radare/radare2/issues/7698"},{"type":"FIX","url":"https://github.com/radare/radare2/commit/f85bc674b2a2256a364fe796351bc1971e106005"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/radare/radare2","events":[{"introduced":"0"},{"last_affected":"91daa516ebf44f0bc422c1f6054a1938df16e25f"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"1.5.0"}]}},{"type":"GIT","repo":"https://github.com/radareorg/radare2","events":[{"introduced":"0"},{"fixed":"f85bc674b2a2256a364fe796351bc1971e106005"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.4-termux4","0.10.5","0.10.6","0.8.6","0.8.8","0.9","0.9.2","0.9.4","0.9.6","0.9.7","0.9.8","0.9.8-rc1","0.9.8-rc2","0.9.8-rc3","0.9.8-rc4","0.9.9","1.0","1.0.0","1.0.1","1.0.2","1.1.0","1.2.0","1.2.0-git","1.3.0","1.3.0-git","1.4.0","1.5.0","radare2-windows-nightly","termux"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-9520.json","vanir_signatures_modified":"2026-04-11T03:11:37Z","vanir_signatures":[{"id":"CVE-2017-9520-1463369f","target":{"file":"libr/core/cbin.c","function":"r_core_bin_set_env"},"deprecated":false,"signature_type":"Function","source":"https://github.com/radareorg/radare2/commit/f85bc674b2a2256a364fe796351bc1971e106005","signature_version":"v1","digest":{"length":893,"function_hash":"176287331169048068014519446979246965043"}},{"id":"CVE-2017-9520-be45c11b","target":{"file":"libr/config/config.c","function":"r_config_set"},"deprecated":false,"signature_type":"Function","source":"https://github.com/radareorg/radare2/commit/f85bc674b2a2256a364fe796351bc1971e106005","signature_version":"v1","digest":{"length":1930,"function_hash":"79059203780100655889398475173598585289"}},{"id":"CVE-2017-9520-cc79945f","target":{"file":"libr/core/cbin.c"},"deprecated":false,"signature_type":"Line","source":"https://github.com/radareorg/radare2/commit/f85bc674b2a2256a364fe796351bc1971e106005","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["183791960127587604471889937694274189674","57223251238555722903857489874342925678","151346299546101784559683188854030576818","9469576686545819922152056240732335509","168437269123251131135648102425443210261","171268881786570126763085531274021807282","183076540113215773977108581591329750216","139522883623943474150755828260568668573","244228412977303805997622847917959312104","90093344064419229953054741697190315777","193000678024019727056034168462441056463","108551911977570361293114646678935623993","135816300997801231492817413148454024734","229252909839171956753031330525572505783","110058798846098240349233660364733601142"]}},{"id":"CVE-2017-9520-dfab808d","target":{"file":"libr/config/config.c"},"deprecated":false,"signature_type":"Line","source":"https://github.com/radareorg/radare2/commit/f85bc674b2a2256a364fe796351bc1971e106005","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["308598182805312281522945467344897079410","8760821368833630665576212967798831100","185133641519768264065842165951575381637","307771205038602884228326919546396902459","37003960473275799048736045447338720011"]}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}