Index index by Group index by Distribution index by Vendor index by creation date index by Name Mirrors Help Search

yara-4.2.3-1.2 RPM for i586

From OpenSuSE Tumbleweed for i586

Name: yara Distribution: openSUSE Tumbleweed
Version: 4.2.3 Vendor: openSUSE
Release: 1.2 Build date: Wed Aug 31 14:05:54 2022
Group: System/Filesystems Build host: lamb12
Size: 61605 Source RPM: yara-4.2.3-1.2.src.rpm
Packager: https://bugs.opensuse.org
Url: https://virustotal.github.io/yara/
Summary: A malware identification and classification tool
YARA is a tool aimed at helping malware researchers to identify and classify
malware samples. With YARA you can create descriptions of malware families
based on textual or binary patterns contained on samples of those families.
Each description consists of a set of strings and a Boolean expression which
determines its logic.

Provides

Requires

License

BSD-3-Clause

Changelog

* Tue Aug 09 2022 Dirk Müller <dmueller@suse.com>
  - update to 4.2.3:
    * BUGFIX: Fix security issue that can lead to arbitrary code execution
    (b77e4f4, b77e4f4). Thanks to ANSSI - CERT-FR for the report.
    * BUGFIX: Fix incorrect logic in expressions like <quantifier> of
      <string_set> in (start..end (#1757).
* Mon Jul 11 2022 Dirk Müller <dmueller@suse.com>
  - update to 4.2.2:
    * BUGFIX: Fix buffer overrun en "dex" module
    * BUGFIX: Wrong offset used when checking Version string of .net metadata
    * BUGFIX: YARA doesn't compile if --with-debug-verbose flag is enabled
    * BUGFIX: Null-pointer dereferences while loading corrupted compiled rules
    * Implement the --skip-larger command-line option in Windows.
    * BUGFIX: Error while scanning process memory in Linux (#1662). Thanks to @hillu.
    * BUGFIX: Issue in "magic" module leading to wrong matches
    * BUGFIX: Multiple issues triggered in low-memory conditions (#1671, #1673, #1674, #1675). Reported by @1ndahous3.
    * BUGFIX: Incorrect parsing of character classes in some regular expressions (#1690). Reported by @Sevaarcen.
    * BUGFIX: Heap overflow in ARM. Reported by @briangreenery.
    * New syntax for counting string occurrences within a range of offsets. Example: #a in
    * New syntax for checking if a set of strings are found within a range of offsets all of them in
    * of operator now accepts sets of rules, Examples: 2 of (rule1, rule2, rule3), 2 of (rule*)
    * New syntactic sugar allows writing 0 of
    * New operator % for string sets. Example: 20% of them
    * New operator defined
    * New operator iequals
    * Added functions abs, count, percentage and mode to math module
    * The dotnet module is now built into YARA by default.
    * Added the is_dotnet field to dotnet module
    * Added new console module
    * Added support of delayed imports to pe module
    * Reduce memory pressure when scanning process memory in Linux
    * Improve performance while matching certain hex strings
    * Implement support for unicode file names in Windows
    * Add new API functions yr_get_configuration_uintXX and yr_set_configuration_uintXX
    * Add --max-process-memory-chunk option for controlling the size of the chunks while scanning a process memory
    * Add --skip-larger option for skipping files larger than a certain size while scanning directories.
    * Improve scanning performance with better atom extraction
    * BUGFIX: fullword modifier not working properly under all locales
    * BUGFIX: Fix edge case when files have a numeric name that was interpreted as a PID number
    * BUGFIX: Fix memory leaks in magic module.
    * BUGFIX: Fix integer overflow while scanning files larger than 2GB
* Fri Nov 05 2021 Arjen de Korte <suse+build@de-korte.org>
  - update to 4.1.3:
    * BUGFIX: Fix issue where ERROR_TOO_MANY_MATCHES was incorrectly returned
    * BUGFIX: Fix potential buffer overrun due to incorrect macro
  - Change license to BSD-3-Clause (upstream changed to this license with
    version 3.5.0)
* Sat Oct 16 2021 Dirk Müller <dmueller@suse.com>
  - update to 4.1.2:
    * BUGFIX: TOO_MANY_MATCHES warning was causing strings to be globally disabled
    * BUGFIX: fullworld modifier not working as expected in Mac OS due to locale issue
    * BUGFIX: Default value for pe.number_of_imported_function not set to 0
* Sat May 29 2021 Ferdinand Thiessen <rpm@fthiessen.de>
  - Update to version 4.1.1
    * BUGFIX: Accept the "+" character as valid in DLL names
    * BUGFIX: Buffer overrun in "macho" module.
    * BUGFIX: Crash due to consecutive jumps in hex strings
* Thu May 06 2021 Ferdinand Thiessen <rpm@fthiessen.de>
  - Update to version 4.1.0
    * New operators icontains, endswith, iendswith, startswith,
      istartswith
    * Accept \t escape sequence in text strings.
    * Add --no-follow-links command-line option to yara.
    * Prevent yara from following links to "."
    * Implemented non-blocking scanning API
    * When a string causes too many matches, YARA raises a warning
      instead of failing
    * BUGFIX: The use of --timeout could hang yara when scanning
      directories or lists of files
    * BUGFIX: Incorrect parsing of PE certificates
    * BUGFIX: Short-circuit evaluation not working fine with
      undefined expressions
  - Drop yara-fix-arm.patch, upstream merged
* Mon Feb 08 2021 Dirk Müller <dmueller@suse.com>
  - update to 4.0.5:
    * Fix bug in "macho" module introduced in v4.0.4.
* Fri Jan 29 2021 Dirk Müller <dmueller@suse.com>
  - update to 4.0.4:
    * Multiple out-of-bounds read in "dotnet" module.
    * Multiple out-of-bounds reads in "macho" module.
* Tue Sep 15 2020 Guillaume GARDET <guillaume.gardet@opensuse.org>
  - Backport upstream patch to fix a segfault on ARM:
    * yara-fix-arm.patch
* Mon Aug 17 2020 Dirk Mueller <dmueller@suse.com>
  - Update to 4.0.2:
    - BUGFIX: Use-after-free bug in PE module (#1287).
    - BUGFIX: Incorrect errors in rules when a single rule is badly
      formatted (#1294).
    - BUGFIX: Assertion failed with rules that have invalid syntax
      (#1295).
    - BUGFIX: Integer overflow causing missed matches on files larger
      than 2GB (#1304).
    - BUGFIX: Crashes in Mac OS while scanning binaries with a
      signature that can't be verified (#1309).
  - Update to 4.0.1:
    - Update sandboxed API (#1276)
    - BUGFIX: Fix regression in exports parsing in PE module
      (2bf67e6)
    - BUGFIX: Fix unaligned accesses in ARM (e1654ae)
  - Update to 4.0.0:
    - New string modifiers base64 and base64wide (#1185).
    - New string modifier private (#1096)
    - Iterators for dictionaries and arrays (#1141).
    - Multiple API changes.
    - Memory footprint greatly reduced, specially when compiling
      large numbers of rules.
    - New commmand-line option --scan-list (#1261).
    - Added pdb_path field to "pe" module.
    - Added export_details array to "pe" module.
    - Added exports_index functions to "pe" module.
    - Improvements to "cuckoo" module.
    - BUGFIX: PE files with multiple signatures are parsed correctly
      (#940).
    - BUGFIX: Fix PE rich header parsing (#1164).
    - BUGFIX: Buffer overruns in "dotnet" module (#1167, #1173).
  - Bump .so version
  - Update to 3.11.0:
    - Duplicated string modifiers are now an error.
    - More flexible “xor” modifier.
    - Implement “private” strings (#1096)
    - Add “field_offsets” to “dotnet” module.
    - Implement “crc32” functions in “hash” module.
    - Improvements to “rich_signature” functions in “pe” module.
    - Implement sandboxed API using SAPI
    - BUGFIX: Some regexp character classes not matching correctly
      when used with “nocase” modifier (#1117)
    - BUGFIX: Reduce the number of ERROR_TOO_MANY_RE_FIBERS errors
      for certain hex pattern containing large jumps (#1107)
    - BUGFIX: Buffer overrun in “dotnet” module (#1108)
    - BUGFIX: Segfault in certain Windows versions (#1068)
    - BUGFIX: Memory leak while attaching to a process fails (#1070)
  - Update to 3.10.0:
    - Optimize integer range loops by exiting earlier when possible.
    - Cache the result of PE module’s imphash function in order to
      improve performance.
    - Harden virtual machine against malicious code.
    - BUGFIX: “xor” modifier not working as expected if not
      accompanied by “ascii” (#1053).
    - BUGFIX: \s and \S character classes in regular expressions now
      include vertical tab, new line, carriage return and form feed
      characters.
    - BUGFIX: Regression bug in hex strings containing wildcards
      (#1025).
    - BUGFIX: Buffer overrun in “elf” module.
    - BUGFIX: Buffer overrun in “dotnet” module.
  - Update to 3.9.0:
    - Improve scan performance for certain strings.
    - Reduce stack usage.
    - Prevent inadvertent use of compiled rules by forcing the use of
    - C when using yara command-line tool.
    - BUGFIX: Buffer overflow in "dotnet" module.
    - BUGFIX: Internal error when running multiple instances of YARA
      in Mac OS X. (#945)
    - BUGFIX: Regexp regression when using nested quantifiers {x,y}
      for certain values of x and y. (#1018)
    - BUGFIX: High RAM consumption in "pe" module while parsing
      certain files.(0c8b461)
    - BUGFIX: Denial of service when using "dex" module. Found by the
      Cisco Talos team. (#1023)
    - BUGFIX: Issues with comments inside hex strings.
  - Update to 3.8.1:
    - BUGFIX: Some combinations of boolean command-line flags were
      broken in version 3.8.0.
    - BUGFIX: While reporting errors that occur at the end of the
      file, the file name appeared as null.
    - BUGFIX: dex module now works in big-endian architectures.
    - BUGFIX: Keep ABI compatibility by keeping deprecated functions
      visible.
  - Update to 3.8.0:
    - Scanner API
    - New “xor” modifier for strings
    - New fields and functions in PE module.
    - Add functions “min” and “max” to math module.
    - Make compiled.
    - yara and yaracsupport reading rules from stdin by using - as
      the file name.
    - Rule compilation is faster.
    - BUGFIX: Regression in regex engine. /ba{3}b/ was matching
      “baaaab”.
    - BUGFIX: Function yr_compiler_add_fd() was reading only the
      first 1024 bytes of the file.
    - BUGFIX: Wrong calculation of sha256 hashes in Windows when
      using native crypto API.
    - Lots of more bug fixes.

Files

/usr/bin/yara
/usr/bin/yarac
/usr/share/doc/packages/yara
/usr/share/doc/packages/yara/AUTHORS
/usr/share/doc/packages/yara/CONTRIBUTORS
/usr/share/doc/packages/yara/README.md
/usr/share/licenses/yara
/usr/share/licenses/yara/COPYING
/usr/share/man/man1/yara.1.gz
/usr/share/man/man1/yarac.1.gz


Generated by rpm2html 1.8.1

Fabrice Bellet, Thu Feb 9 00:21:52 2023