CVE-2017-9465
HighSummary
The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file mishandled in the yr_re_fast_exec and _yr_scan_match_callback functions.
Risk Assessment
Attackers can exploit this vulnerability to disrupt application functionality or steal sensitive data, potentially leading to serious security implications for the organization.
Recommendation
It is recommended to update YARA to the latest version to mitigate this vulnerability and to monitor systems for potential attack attempts.
Other vulnerabilities in YARA 3.6.1
See all- CVE-2017-9438High
The regexp module in YARA 3.5.0 contains a vulnerability that allows remote attackers to cause a denial of service (stack consumption) via a crafted rule involving hex strings, mishandled in the _yr_re_emit function.
- CVE-2017-9304High
The regexp module in YARA 3.5.0 contains a vulnerability that allows remote attackers to cause a denial of service (stack consumption) via a crafted rule mishandled in the _yr_re_emit function.
- CVE-2017-8929High
The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule.
- CVE-2017-8294High
The regex component in YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule, leading to out-of-bounds read and application crash.
- CVE-2017-5924High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_compiler_destroy function, leading to a use-after-free error and application crash.
- CVE-2017-5923High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule, leading to a heap-based out-of-bounds read and application crash.
- CVE-2016-10211High
YARA 3.5.0 has a vulnerability that allows remote attackers to cause a denial of service through a crafted rule mishandled in the yr_parser_lookup_loop_variable function, leading to a use-after-free error and application crash.
- CVE-2016-10210High
In YARA 3.5.0, a vulnerability allows remote attackers to cause application crashes via a crafted rule, leading to a NULL pointer dereference in the yy_get_next_buffer function.
Original NVD description (English source)
The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file that is mishandled in the yr_re_fast_exec function in libyara/re.c and the _yr_scan_match_callback function in libyara/scan.c.