Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2017-5924: YARA 3.5.0 can crash from crafted rule
CVE-2017-5924 · published 9 years ago
Summary
The YARA scanning tool version 3.5.0 may stop working if it processes a specially crafted rule. This happens because the program frees memory too early, leading to a crash. Upgrade to a newer YARA release or apply the vendor’s patch to avoid the interruption.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| virustotal | yara |
3.5.0 cpe:2.3:a:virustotal:yara:3.5.0:*:*:*:*:*:*:* |
Original advisory text
libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_compiler_destroy function.
libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_compiler_destroy function.
References
- http://www.securityfocus.com/bid/98075
- https://github.com/VirusTotal/yara/commit/7f02eca670f29c00a1d2c305e96febae6ce5d3... Patch Vendor Advisory
- https://github.com/VirusTotal/yara/issues/593 Exploit Issue Tracking Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-416Use After Free
Timeline
Published3 Apr 2017
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-5924 · NVD
Track software like this
Free during beta