CVE-2017-9304
published 2017-05-31CVE-2017-9304: libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled…
PriorityP335high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
1.84%
76.6th percentile
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the _yr_re_emit function.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | yara | < yara 3.6.1+dfsg-1 (bookworm) | yara 3.6.1+dfsg-1 (bookworm) |
| virustotal | yara | — | — |
| virustotal | yara | >= 0 < 3.6.1+dfsg-1 | 3.6.1+dfsg-1 |
| virustotal | yara | >= 0 < 3.6.1+dfsg-1 | 3.6.1+dfsg-1 |
| virustotal | yara | >= 0 < 3.6.1+dfsg-1 | 3.6.1+dfsg-1 |
| virustotal | yara | >= 0 < 3.6.1+dfsg-1 | 3.6.1+dfsg-1 |
| virustotal | yara | >= 0 < 3.4.0+dfsg-2ubuntu0.1~esm1 | 3.4.0+dfsg-2ubuntu0.1~esm1 |
| virustotal | yara | >= 0 < 3.7.1-1ubuntu2+esm1 | 3.7.1-1ubuntu2+esm1 |
| virustotal | yara | >= 0 < 3.9.0-1ubuntu0.1~esm1 | 3.9.0-1ubuntu0.1~esm1 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
yara vulnerabilities
osv·2026-03-09·CVSS 7.5
CVE-2016-10211 [HIGH] yara vulnerabilities
yara vulnerabilities
Kamil Frankowicz discovered that a number of YARA's functions
generated memory exceptions when processing specially crafted
rules or files. A remote attacker could possibly use these
issues to cause YARA to crash, resulting in a denial of
service. These issues only affected Ubuntu 16.04 LTS.
(CVE-2016-10211, CVE-2017-5923, CVE-2017-5924, CVE-2017-8294,
CVE-2017-8929, CVE-2017-9304, CVE-2017-9438, CVE-2017-9465)
Jurriaan Bremer discovered that YARA's yr_object_array_set_limit()
function could result in a heap buffer overflow when scanning
specially crafted .NET files. A remote attacker could possibly use
this issue to cause YARA to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11328)
It was discovered that YARA's yr_exe
GHSA
GHSA-24f8-4r56-7793: libyara/re
ghsa_unreviewed·2022-05-13·CVSS 7.5
CVE-2017-9438 [HIGH] CWE-674 GHSA-24f8-4r56-7793: libyara/re
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304.
GHSA
GHSA-cvvq-777c-65v4: libyara/re
ghsa_unreviewed·2022-05-13
CVE-2017-9304 [HIGH] CWE-674 GHSA-cvvq-777c-65v4: libyara/re
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the _yr_re_emit function.
OSV
CVE-2017-9438: libyara/re
osv·2017-06-05·CVSS 7.5
CVE-2017-9438 [HIGH] CVE-2017-9438: libyara/re
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304.
OSV
CVE-2017-9304: libyara/re
osv·2017-05-31·CVSS 7.5
CVE-2017-9304 [HIGH] CVE-2017-9304: libyara/re
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the _yr_re_emit function.
Ubuntu
YARA vulnerabilities
vendor_ubuntu·2026-03-09·CVSS 7.5
CVE-2017-9304 [HIGH] YARA vulnerabilities
Title: YARA vulnerabilities
Summary: Several security issues were fixed in YARA.
Kamil Frankowicz discovered that a number of YARA's functions
generated memory exceptions when processing specially crafted
rules or files. A remote attacker could possibly use these
issues to cause YARA to crash, resulting in a denial of
service. These issues only affected Ubuntu 16.04 LTS.
(CVE-2016-10211, CVE-2017-5923, CVE-2017-5924, CVE-2017-8294,
CVE-2017-8929, CVE-2017-9304, CVE-2017-9438, CVE-2017-9465)
Jurriaan Bremer discovered that YARA's yr_object_array_set_limit()
function could result in a heap buffer overflow when scanning
specially crafted .NET files. A remote attacker could possibly use
this issue to cause YARA to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.0
Debian
CVE-2017-9438: yara - libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause...
vendor_debian·2017·CVSS 7.5
CVE-2017-9438 [HIGH] CVE-2017-9438: yara - libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause...
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304.
Scope: local
bookworm: resolved (fixed in 3.6.1+dfsg-1)
bullseye: resolved (fixed in 3.6.1+dfsg-1)
forky: resolved (fixed in 3.6.1+dfsg-1)
sid: resolved (fixed in 3.6.1+dfsg-1)
trixie: resolved (fixed in 3.6.1+dfsg-1)
Debian
CVE-2017-9304: yara - libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause...
vendor_debian·2017·CVSS 7.5
CVE-2017-9304 [HIGH] CVE-2017-9304: yara - libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause...
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the _yr_re_emit function.
Scope: local
bookworm: resolved (fixed in 3.6.1+dfsg-1)
bullseye: resolved (fixed in 3.6.1+dfsg-1)
forky: resolved (fixed in 3.6.1+dfsg-1)
sid: resolved (fixed in 3.6.1+dfsg-1)
trixie: resolved (fixed in 3.6.1+dfsg-1)
No detection rules found.
No public exploits indexed.
2017-05-31
Published