PatchTheCVEunicorn-engine vulnerabilities
Recent CVEs affecting unicorn-engine products. 7 tracked.
unicorn-engine has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2022-06-02. Highest priority: CVE-2022-29694 (score 56/100).
- CVE-2022-29695 HIGH 7.5 UPGRADE Unicorn Engine v2.0.0-rc7 contains memory leaks caused by an incomplete unicorn engine initialization.
- CVE-2022-29694 HIGH 7.5 UPGRADE Unicorn Engine v2.0.0-rc7 and below was discovered to contain a NULL pointer dereference via qemu_ram_free.
- CVE-2022-29693 HIGH 7.5 UPGRADE Unicorn Engine v2.0.0-rc7 and below was discovered to contain a memory leak via the function uc_close at /my/u
- CVE-2022-29692 HIGH 7.8 DOWNGRADE Unicorn Engine v1.0.3 was discovered to contain a use-after-free vulnerability via the hook function.
- CVE-2021-44078 HIGH 8.1 UPGRADE An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5
- CVE-2021-36979 MEDIUM 5.5 DOWNGRADE MITIGATE Unicorn Engine 1.0.2 has an out-of-bounds write in tb_flush_armeb (called from cpu_arm_exec_armeb and tcg_cpu_
- CVE-2020-36431 MEDIUM 5.5 DOWNGRADE Unicorn Engine 1.0.2 has an out-of-bounds write in helper_wfe_arm.
FAQ
How do I fix unicorn-engine vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is unicorn-engine being exploited right now?
None of the tracked unicorn-engine CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which unicorn-engine CVE should I patch first?
CVE-2022-29694 currently ranks highest (56/100): Unicorn Engine v2.0.0-rc7 and below was discovered to contain a NULL pointer dereference via qemu_ram_free..