PatchTheCVEkeystone-engine vulnerabilities
Recent CVEs affecting keystone-engine products. 2 tracked.
keystone-engine has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2021-07-01. Highest priority: CVE-2020-36405 (score 49/100).
- CVE-2020-36405 HIGH 7.8 DOWNGRADE Keystone Engine 0.9.2 has a use-after-free in llvm_ks::X86Operand::getToken.
- CVE-2020-36404 HIGH 7.8 DOWNGRADE Keystone Engine 0.9.2 has an invalid free in llvm_ks::SmallVectorImpl<llvm_ks::MCFixup>::~SmallVectorImpl.
FAQ
How do I fix keystone-engine vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is keystone-engine being exploited right now?
None of the tracked keystone-engine CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which keystone-engine CVE should I patch first?
CVE-2020-36405 currently ranks highest (49/100): Keystone Engine 0.9.2 has a use-after-free in llvm_ks::X86Operand::getToken..