./security/yara, Pattern matching swiss knife for malware researchers

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 3.6.3, Package name: yara-3.6.3, Maintainer: khorben

YARA is a tool aimed at (but not limited to) helping malware
researchers to identify and classify malware samples. With YARA
you can create descriptions of malware families (or whatever you
want to describe) based on textual or binary patterns.


Required to build:
[pkgtools/cwrappers]

Master sites:

SHA1: 7817b753cc62e2cb14aa7249585f5fe0b032a959
RMD160: ecc0901fa49aa6ae45d9850e6bb6da9ab15cbeca
Filesize: 493.707 KB

Version history: (Expand)


CVS history: (Expand)


   2017-07-06 01:55:01 by Pierre Pronchery | Files touched by this commit (4) | Package updated
Log message:
Update yara to version 3.6.3

From the release notes for version 3.6.3:
* BUGFIX: Heap overflow (4a342f0)
* BUGFIX: Off-by-one NULL write in stack buffer (964d6c0)
* BUGFIX: Multiple issues in "dotnet" module (f40c14c, fc35e5f)

From the release notes for version 3.6.2:

* Increase RE_MAX_AST_LEVELS from 2000 to 6000.
* BUGFIX: Buffer overrun in regexp engine (issue #678)
* BUGFIX: Null pointer dereference in regexp engine (issue #682).

XXX pullup (security fixes)
   2017-06-07 22:46:34 by Thomas Klausner | Files touched by this commit (6)
Log message:
Simplify *yara packages.
   2017-06-07 22:27:37 by Pierre Pronchery | Files touched by this commit (3)
Log message:
Package yara 3.6.1

In the release notes:

 * BUGFIX: Stack overflow caused by uncontrolled recursiveness (CVE-2017-9304)
 * BUGFIX: pe.overlay.size was undefined if the PE didn't have an overlay. Now \ 
it's set to 0 in those cases.
 * BUGFIX: Fix initalization issue that could cause a crash if rules compiled \ 
with a 32bit yarac is used with a 64bit yara.
   2017-06-07 22:11:42 by Pierre Pronchery | Files touched by this commit (3)
Log message:
Package yara 3.6.0

In the release notes:
 * .NET module (Wesley Shields)
 * New features for ELF module (Jacob Baines)
 * Fix endianness issues (Hilko Bengen)
 * Function yr_compiler_add_fd added to libyara
 * MAX_THREADS limit can be arbitrarily increased (Emerson R. Wiley)
 * Added --fail-on-warnings command-line option
 * Multiple bug fixes
   2017-05-15 17:34:12 by Pierre Pronchery | Files touched by this commit (1)
Log message:
Set myself as the maintainer
   2017-05-15 17:27:31 by Pierre Pronchery | Files touched by this commit (7) | Package updated
Log message:
Update security/{,py-yara} to version 3.5.0

The release notes mention:

  * Match length operator \ 
(http://yara.readthedocs.io/en/v3.5.0/wr … tch-length)
  * Performance improvements
  * Less memory consumption while scanning processes
  * Exception handling when scanning memory blocks
  * Negative integers in meta fields
  * Added the --stack-size command-argument
  * Functions import_ordinal, is_dll, is_32bit and is_64bit added to PE module
  * Functions rich_signature.toolid and rich_signature.version added to PE module
  * Lots of bug fixes

The Python bindings are now released from a different tree, with the same
versioning apparently though.

"welcome to update" pettai@
   2016-05-26 16:41:48 by Pierre Pronchery | Files touched by this commit (3) | Package updated
Log message:
Update security/yara to version 3.4.0

The changes include:

 * Short-circuit evaluation for conditions
 * New yr_rules_save_stream/yr_rules_load_stream APIs.
 * load() and save() methods in yara-python accept file-like objects
 * Improvements to the PE and ELF modules
 * Some performance improvements
 * New command-line option --print-module-data
 * Multiple bug fixes.
   2015-11-04 02:18:12 by Alistair G. Crooks | Files touched by this commit (434)
Log message:
Add SHA512 digests for distfiles for security category

Problems found locating distfiles:
	Package f-prot-antivirus6-fs-bin: missing distfile fp-NetBSD.x86.32-fs-6.2.3.tar.gz
	Package f-prot-antivirus6-ws-bin: missing distfile fp-NetBSD.x86.32-ws-6.2.3.tar.gz
	Package libidea: missing distfile libidea-0.8.2b.tar.gz
	Package openssh: missing distfile openssh-7.1p1-hpn-20150822.diff.bz2
	Package uvscan: missing distfile vlp4510e.tar.Z

Otherwise, existing SHA1 digests verified and found to be the same on
the machine holding the existing distfiles (morden).  All existing
SHA1 digests retained for now as an audit trail.