CVE-2021-3402

EPSS 2.2%CWE-190

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 2.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

14 May 2021Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker to either cause denial of service or information disclosure via a malicious Mach-O file. Affects all versions before libyara 4.0.4

Affected products

n/a · libyara

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://bugzilla.redhat.com/show_bug.cgi?id=1930175 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKNXSH5ERG6NELTXCYVJLUPJJJ2TNEBD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXM224OLGI6KAOROLDPPGGCZ2OQVQ6HH/https://www.openwall.com/lists/oss-security/2021/01/29/2 https://www.x41-dsec.de/lab/advisories/x41-2021-001-yara/