CVE-2016-10211
HighSummary
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_parser_lookup_loop_variable function, leading to a use-after-free error and application crash.
Risk Assessment
Organizations may experience service outages, potentially leading to loss of application availability and financial losses.
Recommendation
It is recommended to upgrade to a newer version of YARA to mitigate this vulnerability and to monitor systems for unauthorized rules.
Other vulnerabilities in YARA 3.5.0
See all- CVE-2017-9465High
The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file mishandled in the yr_re_fast_exec and _yr_scan_match_callback functions.
- CVE-2017-9438High
The regexp module in YARA 3.5.0 contains a vulnerability that allows remote attackers to cause a denial of service (stack consumption) via a crafted rule involving hex strings, mishandled in the _yr_re_emit function.
- CVE-2017-9304High
The regexp module in YARA 3.5.0 contains a vulnerability that allows remote attackers to cause a denial of service (stack consumption) via a crafted rule mishandled in the _yr_re_emit function.
- CVE-2017-8929High
The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule.
- CVE-2017-8294High
The regex component in YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule, leading to out-of-bounds read and application crash.
- CVE-2017-5924High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_compiler_destroy function, leading to a use-after-free error and application crash.
- CVE-2017-5923High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule, leading to a heap-based out-of-bounds read and application crash.
- CVE-2016-10210High
In YARA 3.5.0, a vulnerability allows remote attackers to cause application crashes via a crafted rule, leading to a NULL pointer dereference in the yy_get_next_buffer function.
Original NVD description (English source)
libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_parser_lookup_loop_variable function.