CVE catalog

CVE-2019-19648

yara: CVE-2019-19648

Severity: Low
Published: Dec 9, 2019, 1:15:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.54% · Oct 25, 2026

In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size. A specially crafted MachO file can cause an out-of-bounds memory access, resulting in Denial of Service (application crash) or potential code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	yara	sid	`4.5.8-1`	vulnerable
Debian	yara	forky	`4.5.8-1`	vulnerable
Debian	yara	trixie	`4.5.2-1`	vulnerable
Debian	yara	bookworm	`4.2.3-4`	vulnerable
Ubuntu	yara	pro	`3.9.0-1`	vulnerable
Ubuntu	yara	pro	`3.9.0-1ubuntu0.1~esm1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	yara	source	sid	`(unfixed)`	unimportant	Not reported	Not reported
Debian	yara	source	forky	`(unfixed)`	unimportant	Not reported	Not reported
Debian	yara	source	trixie	`(unfixed)`	unimportant	Not reported	Not reported
Debian	yara	source	bookworm	`(unfixed)`	unimportant	Not reported	Not reported
Ubuntu	yara	deb	pro	`3.9.0-1ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2019-19648	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libyara10]Affected
Source package: [yara]
Details (2)
- 4.5.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
- 4.5.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
[libyara9]Affected
Source package: [yara]
Details (2)
- 4.2.3-4 · amd64 · bookworm
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
- 4.2.3-4 · arm64 · bookworm
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
[libyara-dev]Affected
Source package: [yara]
Details (4)
- 4.2.3-4 · amd64 · bookworm
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
- 4.2.3-4 · arm64 · bookworm
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
- 4.5.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
- 4.5.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
[yara]Affected
Details (4)
- 4.2.3-4 · amd64 · bookworm
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
- 4.2.3-4 · arm64 · bookworm
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
- 4.5.2-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
- 4.5.2-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
[yara-doc]Affected
Source package: [yara]
Details (4)
- 4.2.3-4 · all · bookworm
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
- 4.2.3-4 · all · bookworm
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
- 4.5.2-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12
- 4.5.2-1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · yara · debian · bookworm; dsa · yara · debian · 12

[Debian 13 (Trixie)]

[libyara10]Affected
Source package: [yara]
Details (2)
- 4.5.2-1 · amd64 · trixie
  Affected
  dsa · yara · debian · 13
- 4.5.2-1 · arm64 · trixie
  Affected
  dsa · yara · debian · 13
[libyara-dev]Affected
Source package: [yara]
Details (2)
- 4.5.2-1 · amd64 · trixie
  Affected
  dsa · yara · debian · 13
- 4.5.2-1 · arm64 · trixie
  Affected
  dsa · yara · debian · 13
[yara]Affected
Details (2)
- 4.5.2-1 · amd64 · trixie
  Affected
  dsa · yara · debian · 13
- 4.5.2-1 · arm64 · trixie
  Affected
  dsa · yara · debian · 13
[yara-doc]Affected
Source package: [yara]
Details (2)
- 4.5.2-1 · all · trixie
  Affected
  dsa · yara · debian · 13
- 4.5.2-1 · all · trixie
  Affected
  dsa · yara · debian · 13

Observed: Oct 23, 2026, 5:43:23 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]