SB2026030956 - Ubuntu update for yara
Published: March 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 17 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2016-10211)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing a crafted rule that is mishandled in the yr_parser_lookup_loop_variable function. A remote attackers can cause a denial of service (use-after-free and application crash).
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
2) Out-of-bounds read (CVE-ID: CVE-2017-5923)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule that is mishandled in the yara_yyparse function.
3) Use-after-free (CVE-ID: CVE-2017-5924)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing a crafted rule that is mishandled in the yr_compiler_destroy function. A remote attackers can cause a denial of service (use-after-free and application crash).
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
4) Out-of-bounds read (CVE-ID: CVE-2017-8294)
The vulnerability allows a remote attacker to gain access to perform denial of service (DoS) attack.
The vulnerability exists due to a boundary condition within the the regex component function in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled file. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and crash the affected application.
5) Use-after-free (CVE-ID: CVE-2017-8929)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing a crafted rule. A remote attackers can cause a denial of service (use-after-free and application crash).
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
6) Uncontrolled Recursion (CVE-ID: CVE-2017-9304)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the _yr_re_emit function.
7) Uncontrolled Recursion (CVE-ID: CVE-2017-9438)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304.
8) Out-of-bounds read (CVE-ID: CVE-2017-9465)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in The yr_arena_write_data function in YARA 3.6.1. A remote attacker can perform a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file that is mishandled in the yr_re_fast_exec function in libyara/re.c and the _yr_scan_match_callback function in libyara/scan.c.
9) Buffer overflow (CVE-ID: CVE-2017-11328)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Heap buffer overflow in the yr_object_array_set_item() function in object.c in YARA 3.x allows a denial-of-service attack by scanning a crafted .NET file.
10) Information disclosure (CVE-ID: CVE-2018-12034)
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists in the yr_execute_code function, as defined in the source code file libyara/exec.c due to out-of-bounds read. A remote attacker can trick the victim into accessing a YARA rule that submits malicious input, trigger memory corruption and gain access to potentially sensitive information.
11) Out-of-bounds write (CVE-ID: CVE-2018-12035)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists in the yr_execute_code function, as defined in the source code file libyara/exec.c due to out-of-bounds write. A remote attacker can trick the victim into accessing a YARA rule that submits malicious input, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
12) Information disclosure (CVE-ID: CVE-2018-19974)
The vulnerability allows a local attacker to gain access to potentially sensitive information.
The vulnerability exists due to the design of the YARA virtual machine (VM). A local attacker can execute a compiled rule file that submits malicious input and read uninitialized data from VM scratch memory in libyara/exec.c.
13) Information disclosure (CVE-ID: CVE-2018-19975)
The vulnerability allows a local attacker to gain access to potentially sensitive information.
The vulnerability exists due to the design of the YARA virtual machine (VM), which could allow an attacker to use OP_COUNT to read a DWORD value from any arbitrary memory address. A local attacker can execute a compiled rule file that submits malicious input and read data from any arbitrary address in memory, in libyara/exec.c.
14) Information disclosure (CVE-ID: CVE-2018-19976)
The vulnerability allows a local attacker to gain access to potentially sensitive information.
The vulnerability exists due to the design of the YARA virtual machine. A local attacker can execute a compiled rule file that submits malicious input and read uninitialized data from VM scratch memory in libyara/exec.c.
15) Out-of-bounds read (CVE-ID: CVE-2019-19648)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition in the "macho_parse_file" functionality in "macho/macho.c" file when "command_size" may be inconsistent with the real size. A remote attacker can send a specially crafted MachO file, trigger out-of-bounds read error and cause a denial of service condition on the target system.
16) Integer overflow (CVE-ID: CVE-2021-3402)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the macho_parse_fat_file() function in the macho module. A remote attacker can pass specially crafted file to the application, trigger integer overflow and perform a denial of service (DoS) attack.
17) Buffer overflow (CVE-ID: CVE-2021-45429)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the yr_set_configuration() function in yara/libyara/libyara.c. A remote attacker can trick the victim into loading a specially crafted file and crash the application.
Remediation
Install update from vendor's website.