CVE-2019-19648 - In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size

Back Back to CVE browser

HIGH

In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size

Published Dec 9, 2019

7.8

HIGH

CVSS 3.1

EPSS 1.54%

Description

In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size. A specially crafted MachO file can cause an out-of-bounds memory access, resulting in Denial of Service (application crash) or potential code execution.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9258
Advisory
https://github.com/VirusTotal/yara/issues/1178
x_refsource_MISCExploitThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKNXSH5ERG6NELTXCYVJLUPJJJ2TNEBD/
vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXM224OLGI6KAOROLDPPGGCZ2OQVQ6HH/
vendor-advisoryx_refsource_FEDORA

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9258		Advisory
https://github.com/VirusTotal/yara/issues/1178		x_refsource_MISCExploitThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKNXSH5ERG6NELTXCYVJLUPJJJ2TNEBD/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXM224OLGI6KAOROLDPPGGCZ2OQVQ6HH/		vendor-advisoryx_refsource_FEDORA

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 9, 2019

Updated Aug 5, 2024

Reserved Dec 9, 2019

Link CVE-2019-19648

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-19648

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Dec 9, 2019

Updated Aug 5, 2024

Link EUVD-2019-9258

GitHub

No data