CVE-2017-5923

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule that is mishandled in the yara_yyparse function.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Apr 3, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-59247.5libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted ruCVE-2017-59257.5Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern Intel pCVE-2017-59267.5Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern AMD proCVE-2017-59277.5Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern ARM proCVE-2017-59283.7The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by aCVE-2017-59299.8QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.CVE-2017-59302.7The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the deleteCVE-2017-59318.8Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of serviCVE-2017-59327.8The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) chCVE-2017-59335.9Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build 65.11, 11.0 before Build 69.12/69.123, and 11.1 before Build 51.21 randomly genCVE-2017-59346.1Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbiCVE-2017-59367.5OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allo