Use-after-free in YARA - CVE-2017-8929
Published: May 15, 2017 / Updated: January 26, 2021
Vulnerability identifier: #VU38995
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-8929
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing a crafted rule. A remote attackers can cause a denial of service (use-after-free and application crash).
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Affected software
YARA
Fedora
Ubuntu
yara (Ubuntu package)
yara
Fedora
Ubuntu
yara (Ubuntu package)
yara
How to mitigate CVE-2017-8929
Install update from vendor's website.
yara (Ubuntu package) - addressed in versions 3.4.0+dfsg-2ubuntu0.1~esm1, 3.7.1-1ubuntu2+esm1, 3.9.0-1ubuntu0.1~esm1
yara - addressed in versions 3.6.0-1.el7, 3.6.0-1.fc24, 3.6.0-1.fc25, 3.6.0-1.fc26, 3.6.2-1.el6, 3.6.3-1.el6
yara - addressed in versions 3.6.0-1.el7, 3.6.0-1.fc24, 3.6.0-1.fc25, 3.6.0-1.fc26, 3.6.2-1.el6, 3.6.3-1.el6