Bug 1440738 (CVE-2016-10210, CVE-2016-10211, CVE-2017-5923, CVE-2017-5924, CVE-2017-8294)

Summary:	CVE-2017-8294 CVE-2017-5924 CVE-2017-5923 CVE-2016-10210 CVE-2016-10211 yara: Multiple security issues
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rebus
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:10:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1440739, 1440740
Bug Blocks:

Description Andrej Nemec 2017-04-10 12:03:48 UTC

Multiple security issues were found in yara.

CVE-2017-5924 - libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_compiler_destroy function.

https://github.com/VirusTotal/yara/issues/593
https://github.com/VirusTotal/yara/commit/7f02eca670f29c00a1d2c305e96febae6ce5d37b

CVE-2017-5923 - libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule that is mishandled in the yara_yyparse function.

https://github.com/VirusTotal/yara/issues/597
https://github.com/VirusTotal/yara/commit/ab906da53ff2a68c6fd6d1fa73f2b7c7bf0bc636

CVE-2016-10210 - libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted rule that is mishandled in the yy_get_next_buffer function.

https://github.com/VirusTotal/yara/issues/576
https://github.com/VirusTotal/yara/commit/3119b232c9c453c98d8fa8b6ae4e37ba18117cd4

CVE-2016-10211 - libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_parser_lookup_loop_variable function.

https://github.com/VirusTotal/yara/issues/575
https://github.com/VirusTotal/yara/commit/890c3f850293176c0e996a602ffa88b315f4e98f

Comment 1 Andrej Nemec 2017-04-10 12:05:32 UTC

Created yara tracking bugs for this issue:

Affects: epel-all [bug 1440739]
Affects: fedora-all [bug 1440740]

Comment 2 Andrej Nemec 2017-04-27 14:09:57 UTC

Adding a new issue:

CVE-2017-8294 - libyara/re.c in the regex component in YARA 3.5.0 allows remote
attackers to cause a denial of service (out-of-bounds read and
application crash) via a crafted rule that is mishandled in the
yr_re_exec function.

https://github.com/VirusTotal/yara/issues/646
https://github.com/VirusTotal/yara/commit/4cab5b3460b2a655c890df52e7e31a27aa54df68

Comment 3 Product Security DevOps Team 2019-06-08 03:10:04 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.