DescriptionThe yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file that is mishandled in the yr_re_fast_exec function in libyara/re.c and the _yr_scan_match_callback function in libyara/scan.c.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs864517

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
yara (PTS)buster3.9.0-1fixed
sid, trixie4.4.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[stretch] - yara <ignored> (Minor issue, too intrusive to backport)
[jessie] - yara <ignored> (Minor issue, too intrusive to backport)

Search for package or bug name: Reporting problems