CVE-2017-8294
published 2017-04-27CVE-2017-8294: libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted…
PriorityP432high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
3.00%
85.8th percentile
libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled in the yr_re_exec function.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | yara | < yara 3.6.0+dfsg-1 (bookworm) | yara 3.6.0+dfsg-1 (bookworm) |
| virustotal | yara | — | — |
| virustotal | yara | >= 0 < 3.6.0+dfsg-1 | 3.6.0+dfsg-1 |
| virustotal | yara | >= 0 < 3.6.0+dfsg-1 | 3.6.0+dfsg-1 |
| virustotal | yara | >= 0 < 3.6.0+dfsg-1 | 3.6.0+dfsg-1 |
| virustotal | yara | >= 0 < 3.6.0+dfsg-1 | 3.6.0+dfsg-1 |
| virustotal | yara | >= 0 < 3.4.0+dfsg-2ubuntu0.1~esm1 | 3.4.0+dfsg-2ubuntu0.1~esm1 |
| virustotal | yara | >= 0 < 3.7.1-1ubuntu2+esm1 | 3.7.1-1ubuntu2+esm1 |
| virustotal | yara | >= 0 < 3.9.0-1ubuntu0.1~esm1 | 3.9.0-1ubuntu0.1~esm1 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
YARA vulnerabilities
vendor_ubuntu·2026-03-09·CVSS 7.5
CVE-2017-9304 [HIGH] YARA vulnerabilities
Title: YARA vulnerabilities
Summary: Several security issues were fixed in YARA.
Kamil Frankowicz discovered that a number of YARA's functions
generated memory exceptions when processing specially crafted
rules or files. A remote attacker could possibly use these
issues to cause YARA to crash, resulting in a denial of
service. These issues only affected Ubuntu 16.04 LTS.
(CVE-2016-10211, CVE-2017-5923, CVE-2017-5924, CVE-2017-8294,
CVE-2017-8929, CVE-2017-9304, CVE-2017-9438, CVE-2017-9465)
Jurriaan Bremer discovered that YARA's yr_object_array_set_limit()
function could result in a heap buffer overflow when scanning
specially crafted .NET files. A remote attacker could possibly use
this issue to cause YARA to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.0
Debian
CVE-2017-8294: yara - libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cau...
vendor_debian·2017·CVSS 7.5
CVE-2017-8294 [HIGH] CVE-2017-8294: yara - libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cau...
libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled in the yr_re_exec function.
Scope: local
bookworm: resolved (fixed in 3.6.0+dfsg-1)
bullseye: resolved (fixed in 3.6.0+dfsg-1)
forky: resolved (fixed in 3.6.0+dfsg-1)
sid: resolved (fixed in 3.6.0+dfsg-1)
trixie: resolved (fixed in 3.6.0+dfsg-1)
OSV
yara vulnerabilities
osv·2026-03-09·CVSS 7.5
CVE-2016-10211 [HIGH] yara vulnerabilities
yara vulnerabilities
Kamil Frankowicz discovered that a number of YARA's functions
generated memory exceptions when processing specially crafted
rules or files. A remote attacker could possibly use these
issues to cause YARA to crash, resulting in a denial of
service. These issues only affected Ubuntu 16.04 LTS.
(CVE-2016-10211, CVE-2017-5923, CVE-2017-5924, CVE-2017-8294,
CVE-2017-8929, CVE-2017-9304, CVE-2017-9438, CVE-2017-9465)
Jurriaan Bremer discovered that YARA's yr_object_array_set_limit()
function could result in a heap buffer overflow when scanning
specially crafted .NET files. A remote attacker could possibly use
this issue to cause YARA to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11328)
It was discovered that YARA's yr_exe
GHSA
GHSA-9wh4-7wxf-fcgj: libyara/re
ghsa_unreviewed·2022-05-17
CVE-2017-8294 [HIGH] CWE-125 GHSA-9wh4-7wxf-fcgj: libyara/re
libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled in the yr_re_exec function.
OSV
CVE-2017-8294: libyara/re
osv·2017-04-27·CVSS 7.5
CVE-2017-8294 [HIGH] CVE-2017-8294: libyara/re
libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled in the yr_re_exec function.
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/98072https://github.com/VirusTotal/yara/commit/83d799804648c2a0895d40a19835d9b757c6fa4ehttps://github.com/VirusTotal/yara/issues/646http://www.securityfocus.com/bid/98072https://github.com/VirusTotal/yara/commit/83d799804648c2a0895d40a19835d9b757c6fa4ehttps://github.com/VirusTotal/yara/issues/646
2017-04-27
Published