Debian/yara: medium 5.5

In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c. This is a consequence of the design of the YARA virtual machine.

Action: Upgrade yara to 3.8.1-2 or later.

Affected

Fixed versions

Sources

• osv: DEBIAN-CVE-2018-19976
• https://security-tracker.debian.org/tracker/CVE-2018-19976

published 2018-12-17T19:29:02Z · modified 2026-10-23T18:03:04.273983329Z · JSON