Unscored CVE-2018-12035 EUVD-2018-4019GHSA-f8gv-jwf8-mm4p

In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds write vulnerability in yr_execute_code i…

Published Jun 15, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Package: yara Package: yara Ecosystem: Debian Ecosystem: Ubuntu

Description

In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds write vulnerability in yr_execute_code in libyara/exec.c.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	yara	3.7.1-3	—
Debian 13	yara	3.7.1-3	—
Debian 12	yara	3.7.1-3	—

Ubuntu