Vulnerability · Published May 14, 2021 · Assigned by redhat
CVE-2021-3402
Critical 9.1
In plain English
A critical-severity integer overflow in libyara. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)2.2%top 17.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker to either cause denial of service or information disclosure via a malicious Mach-O file. Affects all versions before libyara 4.0.4
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | yara | 4.0.4-1 | DEBIAN-CVE-2021-3402 |
| Debian:13 | yara | 4.0.4-1 | DEBIAN-CVE-2021-3402 |
| Debian:14 | yara | 4.0.4-1 | DEBIAN-CVE-2021-3402 |
Affected products (as reported)
Weakness: CWE-190
References
- FEDORA-2021-f41d5fc954 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-dd62918333 vendor-advisory, x_refsource_FEDORA
- https://bugzilla.redhat.com/show_bug.cgi?id=1930175 x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2021/01/29/2 x_refsource_MISC
- https://www.x41-dsec.de/lab/advisories/x41-2021-001-yara/ x_refsource_MISC