Every CVE whose affected-product data names Virustotal Yara, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (20)
CVE-2021-3402 — CVSS 9.1 (critical): An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker…
CVE-2023-40857 — CVSS 8.8 (high): Buffer Overflow vulnerability in VirusTotal yara v.4.3.2 allows a remote attacker to execute arbtirary code via the yr_execute_cod function…
CVE-2018-12034 — CVSS 7.8 (high): In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds read vulnerability in yr_execute_code in…
CVE-2018-12035 — CVSS 7.8 (high): In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds write vulnerability in yr_execute_code…
CVE-2019-19648 — CVSS 7.8 (high): In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size. A specially…
CVE-2017-8294 — CVSS 7.5 (high): libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application…
CVE-2017-8929 — CVSS 7.5 (high): The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and…
CVE-2017-9304 — CVSS 7.5 (high): libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule…
CVE-2017-9438 — CVSS 7.5 (high): libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule…
CVE-2016-10210 — CVSS 7.5 (high): libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a…
CVE-2016-10211 — CVSS 7.5 (high): libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted…
CVE-2017-5923 — CVSS 7.5 (high): libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash)…
CVE-2017-5924 — CVSS 7.5 (high): libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted…
CVE-2017-9465 — CVSS 7.1 (high): The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application…
CVE-2018-19976 — CVSS 5.5 (medium): In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c. This is a…
CVE-2017-11328 — CVSS 5.5 (medium): Heap buffer overflow in the yr_object_array_set_item() function in object.c in YARA 3.x allows a denial-of-service attack by scanning a…
CVE-2018-19975 — CVSS 5.5 (medium): In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c…
CVE-2019-5020 — CVSS 5.5 (medium): An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can…
CVE-2021-45429 — CVSS 5.5 (medium): A Buffer Overflow vulnerablity exists in VirusTotal YARA git commit: 605b2edf07ed8eb9a2c61ba22eb2e7c362f47ba7 via yr_set_configuration in…
CVE-2018-19974 — CVSS 5.5 (medium): In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. This can…