{"id":"CVE-2022-0519","summary":"Buffer Access with Incorrect Length Value in radareorg/radare2","details":"Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.","modified":"2026-08-18T15:18:20.233123Z","published":"2022-02-08T20:25:11Z","related":["openSUSE-SU-2024:12173-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0519.json","cna_assigner":"@huntrdev","cwe_ids":["CWE-805"]},"references":[{"type":"WEB","url":"https://huntr.dev/bounties/af85b9e1-d1cf-4c0e-ba12-525b82b7c1e3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0519.json"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0519"},{"type":"FIX","url":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/radareorg/radare2","events":[{"introduced":"0"},{"fixed":"2984f4d4600b1fd6835da926dc7c4cefb7f0dee5"},{"fixed":"6c4428f018d385fc80a33ecddcb37becea685dd5"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.6.2"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*"}}],"versions":["5.6.0","5.5.4","5.5.2","5.5.0","5.4.2","5.4.0","5.4.0-git","5.3.1","5.3.0","5.2.1","5.2.0","5.1.1","5.1.0","release-5.0.0","5.0.0","4.5.1","4.4.0","4.3.1","Continuous-Windows","4.3.0","continuous","4.2.1","4.2.0","4.1.1","4.1.0","4.0.0","3.9.0","3.8.0","3.7.1","3.7.0","3.6.0","3.5.1","3.5.0","3.4.1","3.4.0","3.3.0","3.2.1","3.2.0","3.1.3","3.1.2","3.1.1","3.1.0","3.0.1","3.0.0","2.9.0","2.8.0","2.7.0","2.6.9","2.6.0","2.5.0","2.4.0","2.2.0","2.1.0","2.0.1","2.0.0","1.6.0","1.5.0","1.4.0","1.3.0","1.3.0-git","1.2.0","1.2.0-git","1.1.0","1.0.2","1.0.1","1.0.0","1.0","0.10.6","0.10.5","0.10.4-termux4","termux","0.10.4","0.10.3","0.10.2","0.10.1","0.10.0","radare2-windows-nightly","0.9.9","0.9.8","0.9.8-rc4","0.9.8-rc3","0.9.8-rc2","0.9.8-rc1","0.9.7","0.9.6","0.9.4","0.9.2","0.9","0.8.8","0.8.6"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-0519.json","vanir_signatures_modified":"2026-08-18T15:18:20Z","vanir_signatures":[{"digest":{"length":552,"function_hash":"38654977037800418505380726227198693568"},"id":"CVE-2022-0519-13c6e8b4","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_annotation_default_attr_new"},"deprecated":false},{"digest":{"function_hash":"334162841532923193614200129841161232657","length":823},"id":"CVE-2022-0519-1884fe69","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_rtv_annotations_attr_new"},"deprecated":false},{"source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_stack_map_frame_new"},"deprecated":false,"digest":{"function_hash":"199818388222783077276587258262387328143","length":5851},"id":"CVE-2022-0519-31234177","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"function":"r_bin_java_enclosing_methods_attr_new","file":"shlr/java/class.c"},"deprecated":false,"digest":{"function_hash":"282344491457731228480726280127198927401","length":1356},"id":"CVE-2022-0519-34c7a1d0","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"255730261067617219060313173435627128445","length":284},"id":"CVE-2022-0519-35f24a6c","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_synthetic_attr_new"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c"},"deprecated":false,"digest":{"line_hashes":["165577962209837574281969992791609623641","154578092079991899007135477318489681185","8792115896356286250235711055843451224","54482633386213525813923284593229153720","177396928595721860366839005168334512114","149853491893390327565138374708204685221","335652189466822274110973820426017429537","66269600364332507973044164762133104698","234649201278073925588580297131079863557","203440940773422808639307439783405720547","185570776764941832332398249484919025512","319455279010717405642366901179748023496","251986652731428107414301329386420518686","33227264105718779923801939173160394237","256019872834675443982101202602095902237","74279526735016488349581314889499910525","75552170463465050352240877736555745064","312827424394807798296967368342696562342","296881754146233207271199558148266366023","313495798557323062736091567635678655080","307440175824729540310223955080825638108","26332029639040479828871705561342356008","43428393363750151273711771200036719060","96235715748446742381679918957763190216","181788260483155699889419752742568017257","283086688358362822363461440502122750973","145721381840907178029102021600576016254","195202011515469925306040042403928335780","44783237612683273509379839073259140046","292833117088492394586622338164142713138","120742792985553591401888679492321120010","334502324074924113352324596179524367072","4441867046170206248295104071492387582","87914659180353199662795135427251279018","131501429378214498485589104966640253009","148906254548627192151893373639316449789","34314878874921785715961221704460638254","264608050026331379535817127116001862262","138652562392469679740311710442332470110","54328774917705282040333382197682188713","118714756796665719989338319325372507430","334023340089492573823857960790347846918","267940230134596105690537583911837895962","228047803195483441218892481228778718877","140883456752850374031870539343120095396","70599117420443064850987711252955920221","16356978250030019864281384642470828286","316483341562520659462987513428502784603","47828099086695248429438134778389843837","17311418610044673751403331393214782798","200592625959370589177846613516441529290","70069781523035277536516228234596177468","86217560966718965419769876951733488943","321416952462912692092772992844444580547","20754435265644749875264518389203378186","19042768144513814169344980679602291046","285969247255335362390293944413404123888","10273147649579872887135408802725847708","225630655541982814622437340840685118029","311932748435452010851256017554476200705","22409125729342499619484153205090066469","163726140407708139458491061702059768473","112158365377809238517086730523267391691","11342329254888576787063575068028210889","122286243574369308685894169021317050608","282685782239279318490365812981821401425","44806293863537985729955995523259238852","312086477912756838636653278741941619708","2378820514499628140766643252895368513","56264480478791202725479020128661072141","34539943785576354635771326265845233878","227991996819493261592926565414600450254","140654944652385198012323462902845233940","121082137937443121802720227738865116770","286969420049745497239624522447128647163","204726680701854239112739577615271234601","250733085125537520627054030210774716586","118972498865419744206060028160966393877","171675947646882816163018877564183457726","71803288742721269787904654447242286560","334302753400944093451895194368691107252","285741809878344199722949798201874141486","41344453556191368772582609698472167165","284434246529088147506941725176589757811","327216980416237932749096776511154919494","249637170085911187156099595883711555770","267983710103477965972808065260210778812","246316221464456037699707026222955885138","76958268034632818607064855847131541224","27192399818387413611566320564770071150","47430346598984965199820602235988832262","293908915331736754853714312380591309467","247654043157556067226346330357533787868","147499657126450735172903754477400012748","63824738091413336127468547697187394999","137603135814011398971197036642434389148","332494644048954382449454404593735964080","140721476786666962873657604104392057603","103698321416953651200278881508018323074","243031463960803550515978774077586110065","218233869974906013181716371066872980978","188348724671440167144827934290299827588","117864574456640118725907562953667808988","102691569205924662161444522811087185079","42757270698871486944878315870847288630","180005548821653216264439247030662425571","92705351442894437738356988806060457657","166644397782675624998121444116997018946","138655877623749637746719456881558358511","330593077369371598145440672826830881762","161787592413048183659581646728226398834","105953245775737290606070861916675549708","82144474567981329189884820222585623552","258356475879444102749793207289071830427","144167948140229970742513268808953348566","256053286438767209611564838484536107874","208112421723650012423744490790803436066","244743749791930917046622134381351883530","279180923398016386920517617934145042752","262416174105069758841051197393768781058","141169253432528526367561313686570616403","66191657955300893623828530634979020825","91370720201603380068276629984298441934","203518640826125885615760313875501724925","2052054535228223959994273951395623402","892958942663825622049748044492567065","317807068220465946098210603474519736987","191720454974703803771588665928529118837","16304969771088023822701667061675932974","255411635108026139510646697207801091493"],"threshold":0.9},"id":"CVE-2022-0519-41f21e1e"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_source_code_file_attr_new"},"deprecated":false,"digest":{"function_hash":"226936501527367015598502298646696165597","length":407},"id":"CVE-2022-0519-462f1178"},{"id":"CVE-2022-0519-4bcfa4c1","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_local_variable_type_table_attr_new"},"deprecated":false,"digest":{"function_hash":"97658140708251857916291701659706161691","length":1778}},{"deprecated":false,"digest":{"function_hash":"62850572014049310416001165109743351489","length":687},"id":"CVE-2022-0519-54e3a40c","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_annotation_new"}},{"digest":{"function_hash":"181842307123567934839469580309488527684","length":372},"id":"CVE-2022-0519-6c1937d1","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_verification_info_from_type"},"deprecated":false},{"source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_local_variable_table_attr_new"},"deprecated":false,"digest":{"function_hash":"43345711010878620379053030663442973274","length":1740},"id":"CVE-2022-0519-6e14f7f2","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2022-0519-7dcdb80c","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_element_value_new"},"deprecated":false,"digest":{"function_hash":"55437132587865367010832040418248126141","length":3079}},{"deprecated":false,"digest":{"function_hash":"163689900197696503818017736123962344244","length":177},"id":"CVE-2022-0519-9aa7926c","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_element_pair_calc_size"}},{"deprecated":false,"digest":{"function_hash":"230968582192998333903229250248917188970","length":1275},"id":"CVE-2022-0519-d331e602","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_source_debug_attr_new"}},{"target":{"file":"shlr/java/class.c","function":"r_bin_java_read_from_buffer_verification_info_new"},"deprecated":false,"digest":{"function_hash":"46950818428031679760341248995784109566","length":580},"id":"CVE-2022-0519-dc6effef","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5"},{"deprecated":false,"digest":{"function_hash":"273458523926168414381314317740662997411","length":2137},"id":"CVE-2022-0519-e21d507f","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_inner_classes_attr_new"}},{"id":"CVE-2022-0519-ee679987","signature_type":"Function","signature_version":"v1","source":"https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5","target":{"file":"shlr/java/class.c","function":"r_bin_java_stack_map_table_attr_new"},"deprecated":false,"digest":{"length":1748,"function_hash":"141663227747815711413960016671987084677"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"}]}