CVE-2017-8294
HighSummary
The regex component in YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule, leading to out-of-bounds read and application crash.
Risk Assessment
The organization may experience application downtime, potentially resulting in loss of service availability and financial losses.
Recommendation
It is recommended to update YARA to the latest version to mitigate this vulnerability and to monitor systems for unauthorized rules.
Other vulnerabilities in YARA 3.5.0
See all- CVE-2017-9465High
The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file mishandled in the yr_re_fast_exec and _yr_scan_match_callback functions.
- CVE-2017-9438High
The regexp module in YARA 3.5.0 contains a vulnerability that allows remote attackers to cause a denial of service (stack consumption) via a crafted rule involving hex strings, mishandled in the _yr_re_emit function.
- CVE-2017-9304High
The regexp module in YARA 3.5.0 contains a vulnerability that allows remote attackers to cause a denial of service (stack consumption) via a crafted rule mishandled in the _yr_re_emit function.
- CVE-2017-8929High
The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule.
- CVE-2017-5924High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_compiler_destroy function, leading to a use-after-free error and application crash.
- CVE-2017-5923High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule, leading to a heap-based out-of-bounds read and application crash.
- CVE-2016-10211High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_parser_lookup_loop_variable function, leading to a use-after-free error and application crash.
- CVE-2016-10210High
In YARA 3.5.0, a vulnerability allows remote attackers to cause application crashes via a crafted rule, leading to a NULL pointer dereference in the yy_get_next_buffer function.
Original NVD description (English source)
libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled in the yr_re_exec function.