CVE-2018-19975

2018-12-1719:29:01

Google

osv.dev

6.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

45.9%

JSON

In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c. Specifically, OP_COUNT can read a DWORD.

CPENameOperatorVersion
yaraeq3.6.0
yaraeq2.1.0
yaraeq3.3.0
yaraeq3.7.0
yaraeq3.8.0
yaraeq3.4.0
yaraeq3.0.0
yaraeq3.2.0
yaraeq3.1.0
yaraeq2.0.0

Name	Operator	Version
yara	eq	3.6.0
yara	eq	2.1.0
yara	eq	3.3.0
yara	eq	3.7.0
yara	eq	3.8.0
yara	eq	3.4.0
yara	eq	3.0.0
yara	eq	3.2.0
yara	eq	3.1.0
yara	eq	2.0.0

Rows per page:

1-10 of 111

References

bnbdr.github.io/posts/extracheese/

github.com/bnbdr/swisscheese/

github.com/VirusTotal/yara/issues/999

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFFXDAMP6GJ337LIOTVF5I4T6QGMN3ZR/