Multiple security issues were found in yara. CVE-2017-5924 - libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_compiler_destroy function. https://github.com/VirusTotal/yara/issues/593 https://github.com/VirusTotal/yara/commit/7f02eca670f29c00a1d2c305e96febae6ce5d37b CVE-2017-5923 - libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule that is mishandled in the yara_yyparse function. https://github.com/VirusTotal/yara/issues/597 https://github.com/VirusTotal/yara/commit/ab906da53ff2a68c6fd6d1fa73f2b7c7bf0bc636 CVE-2016-10210 - libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted rule that is mishandled in the yy_get_next_buffer function. https://github.com/VirusTotal/yara/issues/576 https://github.com/VirusTotal/yara/commit/3119b232c9c453c98d8fa8b6ae4e37ba18117cd4 CVE-2016-10211 - libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_parser_lookup_loop_variable function. https://github.com/VirusTotal/yara/issues/575 https://github.com/VirusTotal/yara/commit/890c3f850293176c0e996a602ffa88b315f4e98f
Created yara tracking bugs for this issue: Affects: epel-all [bug 1440739] Affects: fedora-all [bug 1440740]
Adding a new issue: CVE-2017-8294 - libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled in the yr_re_exec function. https://github.com/VirusTotal/yara/issues/646 https://github.com/VirusTotal/yara/commit/4cab5b3460b2a655c890df52e7e31a27aa54df68
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.