CVE-2021-3402 — Vulnetix

CVE-2021-3402 PUBLISHED

An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker to either cause denial of service or information disclosure via a malicious Mach-O file. Affects all versions before libyara 4.0.4

EPSS 0.47% · 64.9th percentile

Risk Scores

EPSS Score

0.47%

64.9th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:20.04:LTS	yara	0, 3.9.0-1

Exploit Intelligence

https://www.openwall.com/lists/oss-security/2021/01/29/2 (nist-nvd)
https://www.x41-dsec.de/lab/advisories/x41-2021-001-yara/ (nist-nvd)
FEDORA-2021-f41d5fc954 (circl)
FEDORA-2021-dd62918333 (circl)
https://bugzilla.redhat.com/show_bug.cgi?id=1930175 (circl)

Timeline

May 14, 2021 CVE Published
May 15, 2021 EPSS Score
Jul 18, 2021 EPSS Score
Nov 18, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Jan 19, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Apr 1, 2022 EPSS Score
May 22, 2022 EPSS Score
Jul 24, 2022 EPSS Score
Sep 23, 2022 EPSS Score
Jan 25, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2021-3402 third-party-advisory
https://www.openwall.com/lists/oss-security/2021/01/29/2 third-party-advisory
https://www.x41-dsec.de/lab/advisories/x41-2021-001-yara/ third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2021-3402 third-party-advisory

Open in Interactive Console →