CVE-2017-9304

libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the yrre_emit function.

References

Affected packages

Debian:11 / yara

Package

Name: yara
Purl: pkg:deb/debian/yara?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.6.1+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / yara

Package

Name: yara
Purl: pkg:deb/debian/yara?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.6.1+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / yara

Package

Name: yara
Purl: pkg:deb/debian/yara?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.6.1+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/virustotal/yara

Affected ranges

Type: GIT
Repo: https://github.com/virustotal/yara
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

925bcf3c3b0a28b5b78e25d9efda5c0bf27ae699