CVE-2025-1378

A vulnerability, which was classified as problematic, was found in radare2. Affected is an unknown function in the library /libr/main/rasm2.c of the component rasm2. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

This update for radare2 fixes the following issues:

• CVE-2025-1378: Fixed memory corruption (boo#1237250)

  https://github.com/radareorg/radare2/releases/tag/5.9.0

Update to version 5.8.8:

For details, check full release notes

• Faster analysis, type matching, binary parsing (2-4x)
• Add assembler for riscv and disassemblers for PDP11, Alpha64 and armv7.v35
• Improved integration with r2frida remote filesystems
• Cleaning debugger for windows (32 and 64) and macOS makes it more reliable and stable
• Better build scripts for Windows (add asan and w32 profiles)
• AES key wrap algorithm support in rahash2
• Print and convert ternary values back and forth

• Update to 4.5.0
  • Fix build of the onefied shared lib
  • Enable asm.jmpsub by default
  • Fix m68k analysis issues
  • Fix infinite loop bug related to anal.nopskip

These are all security issues fixed in the radare2-5.9.8-2.1 package on the GA media of openSUSE Tumbleweed.

This update for radare2 fixes the following issues:

Changes in radare2:

• Update to version 6.1.4 (bsc#1262142, CVE-2026-40499):

  • Analysis: improve autoname scoring, jmptbl detection, and performance
  • Add callargs modifier, rnum expressions, and typed function context
  • Refactor autoname into plugin; extend RAnalPlugin hooks
  • Fix leaks, overflows, and command injection in analysis scripts
  • Improve string detection, wide strings, and switch/case analysis
  • Arch: fix v850/nds32 ESIL, optimize to O(1), improve pseudo support
  • Cache capstone options and improve multi-arch disassembly
  • ASM: add camel syntax support, unify via RArch API
  • Bin: major parser fixes (ELF, Mach-O, PE, DEX, PDB, WAD, XCOFF)
  • Fix leaks, OOB reads/writes, overflows, and improve bounds checks
  • Improve Swift demangling, ARM hints, relocations, and imports
  • Add nds32 reloc support and optimize kernelcache parsing
  • Build: install to lib64, fix illumos and packaging issues
  • CI: add GitHub Actions and FilC builds
  • Console: fix multiple overflows, OOB issues, and improve performance
  • Core: API renames, plugin load order, sandbox/config fixes
  • Crash: extensive fixes (UAF, OOB, overflows, injections, fuzz bugs)
  • Harden ELF, PDB, kernelcache, regex, disassemblers, and webserver
  • Debug: improve ptrace, winkd support, breakpoints, checkpoints
  • Disasm: cache flag lookups for performance
  • FS/IO: fix leaks, bounds, sparse IO, and device handling
  • HTTP/socket: webserver fixes and SSL fallback handling
  • Print/projects: improve formatting, endian handling, project metadata
  • Pseudo: add while/switch support and cleaner control flow
  • Search/shell: improve commands, parsing, and usability
  • Security: fix widespread command injection and sandbox escapes
  • Tests/tools: improve r2r, CLI tools, fuzzing, and plugin support
  • Types/util: parsing improvements, JSON/base64 updates, optimizations
  • Visual: fix UAF/leaks, improve panels and UX
  • Full changelog is available at: https://github.com/radareorg/radare2/releases/tag/6.1.4

• Update to version 6.1.2:

  • Analysis: preserve timeouts, improve bb/jmptbl validation and limits
  • Optimize string detection and hot-path functions
  • Add APIs for function signatures, vars limits, and instruction hints
  • Fix overlapped functions, invalid code checks, and large bb handling
  • API: remove deprecated librmagic/filetype APIs and name filter
  • Arch: fix Thumb/endianness issues, add Python pseudo plugin
  • ASM: unify settings via RArch, fix directives, add bf pseudo plugin
  • Bin: improve ELF/Mach-O stripped detection and parsing safety
  • Harden Mach-O bounds, optimize kernelcache and XNU parsing
  • Fix many leaks (DEX, demangler, parsers) and infinite loops
  • Improve DWARF handling and symbol/type extraction
  • Build: improve meson, toolchains, and add ISO/docker support
  • Console: preserve timeout, fix themes and UTF-8 handling
  • Core: fix config bugs, improve startup and addressing support
  • Crash: fix UAF, OOB, race conditions, regex bugs, and overflows
  • Add safety checks across dotnet, Mach-O, DWARF, and webserver
  • Debug/ESIL: safer execution and divide-by-zero handling
  • FS/IO: fix HFS+, dyldcache speedups, safer zip handling
  • Graph: add bb size limit option
  • Print: merge commands, improve UTF-8 and formatting
  • Projects/tools: new configs, plugin support, CLI improvements
  • Search: faster analysis search and block buffering
  • Shell: improve grep/macros and file operations
  • Types: lazy-load, cache, and improve parsing (varargs, structs)
  • Tests: expand fuzzing and test suites
  • General cleanup, performance tuning, and safety improvements
  • Full changelog is available at: https://github.com/radareorg/radare2/releases/tag/6.1.4

• Update to version 6.1.0:

  • Reimplement RBufRef using RRef; fix RLibDelHandler API
  • Remove stale JAY code; improve analysis performance and CI speed
  • Optimize type…