UBUNTU-CVE-2018-19974

Details

In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. This can allow attackers to discover addresses in the real stack (not the YARA virtual stack).

Affected Packages

yara

Ubuntu Pro 16.04 LTSUbuntu 16.04 LTS

Affected versions:

3.4.0+dfsg-23.4.0+dfsg-2build1

yara

Ubuntu Pro 18.04 LTSUbuntu 18.04 LTS

Affected versions:

3.6.3+dfsg-1ubuntu13.7.1-1ubuntu13.7.1-1ubuntu2

yara

Ubuntu 25.04

Affected versions:

4.5.1-14.5.2-1

References

REPORT

https://bnbdr.github.io/posts/extracheese/

REPORT

https://github.com/VirusTotal/yara/issues/999

REPORT

https://github.com/bnbdr/swisscheese/

REPORT

https://ubuntu.com/security/CVE-2018-19974

REPORT

https://www.cve.org/CVERecord?id=CVE-2018-19974