UBUNTU-CVE-2018-19975

Details

In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c. Specifically, OP_COUNT can read a DWORD.

Affected Packages

yara

Ubuntu Pro 16.04 LTSUbuntu 16.04 LTS

Affected versions:

3.4.0+dfsg-23.4.0+dfsg-2build1

yara

Ubuntu Pro 18.04 LTSUbuntu 18.04 LTS

Affected versions:

3.6.3+dfsg-1ubuntu13.7.1-1ubuntu13.7.1-1ubuntu2

yara

Ubuntu 25.04

Affected versions:

4.5.1-14.5.2-1

References

REPORT

https://bnbdr.github.io/posts/extracheese/

REPORT

https://github.com/VirusTotal/yara/issues/999

REPORT

https://github.com/bnbdr/swisscheese/

REPORT

https://ubuntu.com/security/CVE-2018-19975

REPORT

https://www.cve.org/CVERecord?id=CVE-2018-19975