Unscored CVE-2018-19975 EUVD-2018-11642GHSA-qmr8-5qxx-8j5h

In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c. Specifi…

Published Dec 17, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Package: yara Package: yara Ecosystem: Debian Ecosystem: Ubuntu

Description

In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c. Specifically, OP_COUNT can read a DWORD.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	yara	3.8.1-2	—
Debian 13	yara	3.8.1-2	—
Debian 12	yara	3.8.1-2	—

Ubuntu