CVE-2017-9438
HighSummary
The regexp module in YARA 3.5.0 contains a vulnerability that allows remote attackers to cause a denial of service (stack consumption) via a crafted rule involving hex strings, mishandled in the _yr_re_emit function.
Risk Assessment
Attackers can exploit this vulnerability to disrupt system operations, potentially leading to service downtime and loss of application availability.
Recommendation
It is recommended to upgrade to a newer version of YARA that addresses this vulnerability and to review the rules used in the application to minimize risk.
Other vulnerabilities in YARA 3.5.0
See all- CVE-2017-9465High
The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file mishandled in the yr_re_fast_exec and _yr_scan_match_callback functions.
- CVE-2017-9304High
The regexp module in YARA 3.5.0 contains a vulnerability that allows remote attackers to cause a denial of service (stack consumption) via a crafted rule mishandled in the _yr_re_emit function.
- CVE-2017-8929High
The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule.
- CVE-2017-8294High
The regex component in YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule, leading to out-of-bounds read and application crash.
- CVE-2017-5924High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_compiler_destroy function, leading to a use-after-free error and application crash.
- CVE-2017-5923High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule, leading to a heap-based out-of-bounds read and application crash.
- CVE-2016-10211High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_parser_lookup_loop_variable function, leading to a use-after-free error and application crash.
- CVE-2016-10210High
In YARA 3.5.0, a vulnerability allows remote attackers to cause application crashes via a crafted rule, leading to a NULL pointer dereference in the yy_get_next_buffer function.
Original NVD description (English source)
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304.