CVE-2021-3402
published 2021-05-14CVE-2021-3402: An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker to either cause…
PriorityP344critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
2.22%
80.7th percentile
An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker to either cause denial of service or information disclosure via a malicious Mach-O file. Affects all versions before libyara 4.0.4
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | yara | < yara 4.0.4-1 (bookworm) | yara 4.0.4-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| virustotal | yara | < 4.0.4 | 4.0.4 |
| virustotal | yara | >= 0 < 4.0.4-1 | 4.0.4-1 |
| virustotal | yara | >= 0 < 4.0.4-1 | 4.0.4-1 |
| virustotal | yara | >= 0 < 4.0.4-1 | 4.0.4-1 |
| virustotal | yara | >= 0 < 4.0.4-1 | 4.0.4-1 |
| virustotal | yara | >= 0 < 3.4.0+dfsg-2ubuntu0.1~esm1 | 3.4.0+dfsg-2ubuntu0.1~esm1 |
| virustotal | yara | >= 0 < 3.7.1-1ubuntu2+esm1 | 3.7.1-1ubuntu2+esm1 |
| virustotal | yara | >= 0 < 3.9.0-1ubuntu0.1~esm1 | 3.9.0-1ubuntu0.1~esm1 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
osv9.1CRITICAL
vendor_debian9.1CRITICAL
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
YARA vulnerabilities
vendor_ubuntu·2026-03-09·CVSS 7.5
CVE-2017-9304 [HIGH] YARA vulnerabilities
Title: YARA vulnerabilities
Summary: Several security issues were fixed in YARA.
Kamil Frankowicz discovered that a number of YARA's functions
generated memory exceptions when processing specially crafted
rules or files. A remote attacker could possibly use these
issues to cause YARA to crash, resulting in a denial of
service. These issues only affected Ubuntu 16.04 LTS.
(CVE-2016-10211, CVE-2017-5923, CVE-2017-5924, CVE-2017-8294,
CVE-2017-8929, CVE-2017-9304, CVE-2017-9438, CVE-2017-9465)
Jurriaan Bremer discovered that YARA's yr_object_array_set_limit()
function could result in a heap buffer overflow when scanning
specially crafted .NET files. A remote attacker could possibly use
this issue to cause YARA to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.0
Debian
CVE-2021-3402: yara - An integer overflow and several buffer overflow reads in libyara/modules/macho/m...
vendor_debian·2021·CVSS 9.1
CVE-2021-3402 [CRITICAL] CVE-2021-3402: yara - An integer overflow and several buffer overflow reads in libyara/modules/macho/m...
An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker to either cause denial of service or information disclosure via a malicious Mach-O file. Affects all versions before libyara 4.0.4
Scope: local
bookworm: resolved (fixed in 4.0.4-1)
bullseye: resolved (fixed in 4.0.4-1)
forky: resolved (fixed in 4.0.4-1)
sid: resolved (fixed in 4.0.4-1)
trixie: resolved (fixed in 4.0.4-1)
OSV
yara vulnerabilities
osv·2026-03-09·CVSS 7.5
CVE-2016-10211 [HIGH] yara vulnerabilities
yara vulnerabilities
Kamil Frankowicz discovered that a number of YARA's functions
generated memory exceptions when processing specially crafted
rules or files. A remote attacker could possibly use these
issues to cause YARA to crash, resulting in a denial of
service. These issues only affected Ubuntu 16.04 LTS.
(CVE-2016-10211, CVE-2017-5923, CVE-2017-5924, CVE-2017-8294,
CVE-2017-8929, CVE-2017-9304, CVE-2017-9438, CVE-2017-9465)
Jurriaan Bremer discovered that YARA's yr_object_array_set_limit()
function could result in a heap buffer overflow when scanning
specially crafted .NET files. A remote attacker could possibly use
this issue to cause YARA to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11328)
It was discovered that YARA's yr_exe
GHSA
GHSA-2c7q-h8gj-7hgc: An integer overflow and several buffer overflow reads in libyara/modules/macho/macho
ghsa_unreviewed·2022-05-24
CVE-2021-3402 [CRITICAL] CWE-190 GHSA-2c7q-h8gj-7hgc: An integer overflow and several buffer overflow reads in libyara/modules/macho/macho
An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker to either cause denial of service or information disclosure via a malicious Mach-O file. Affects all versions before libyara 4.0.4
OSV
CVE-2021-3402: An integer overflow and several buffer overflow reads in libyara/modules/macho/macho
osv·2021-05-14·CVSS 9.1
CVE-2021-3402 [CRITICAL] CVE-2021-3402: An integer overflow and several buffer overflow reads in libyara/modules/macho/macho
An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker to either cause denial of service or information disclosure via a malicious Mach-O file. Affects all versions before libyara 4.0.4
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1930175https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKNXSH5ERG6NELTXCYVJLUPJJJ2TNEBD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXM224OLGI6KAOROLDPPGGCZ2OQVQ6HH/https://www.openwall.com/lists/oss-security/2021/01/29/2https://www.x41-dsec.de/lab/advisories/x41-2021-001-yara/https://bugzilla.redhat.com/show_bug.cgi?id=1930175https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKNXSH5ERG6NELTXCYVJLUPJJJ2TNEBD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXM224OLGI6KAOROLDPPGGCZ2OQVQ6HH/https://www.openwall.com/lists/oss-security/2021/01/29/2https://www.x41-dsec.de/lab/advisories/x41-2021-001-yara/
2021-05-14
Published