Index index by Group index by Distribution index by Vendor index by creation date index by Name Mirrors Help Search

libyara8-4.1.3-1.1 RPM for riscv64

From OpenSuSE Ports Tumbleweed for riscv64

Name: libyara8 Distribution: openSUSE Tumbleweed
Version: 4.1.3 Vendor: openSUSE
Release: 1.1 Build date: Sun Nov 7 00:22:18 2021
Group: System/Libraries Build host: build74
Size: 283428 Source RPM: yara-4.1.3-1.1.src.rpm
Summary: Library to support the yara malware identification tool
YARA is a tool aimed at helping malware researchers to identify and classify
malware samples. With YARA you can create descriptions of malware families
based on textual or binary patterns contained on samples of those families.
Each description consists of a set of strings and a Boolean expression which
determines its logic.






* Fri Nov 05 2021 Arjen de Korte <>
  - update to 4.1.3:
    * BUGFIX: Fix issue where ERROR_TOO_MANY_MATCHES was incorrectly returned
    * BUGFIX: Fix potential buffer overrun due to incorrect macro
  - Change license to BSD-3-Clause (upstream changed to this license with
    version 3.5.0)
* Sat Oct 16 2021 Dirk Müller <>
  - update to 4.1.2:
    * BUGFIX: TOO_MANY_MATCHES warning was causing strings to be globally disabled
    * BUGFIX: fullworld modifier not working as expected in Mac OS due to locale issue
    * BUGFIX: Default value for pe.number_of_imported_function not set to 0
* Sat May 29 2021 Ferdinand Thiessen <>
  - Update to version 4.1.1
    * BUGFIX: Accept the "+" character as valid in DLL names
    * BUGFIX: Buffer overrun in "macho" module.
    * BUGFIX: Crash due to consecutive jumps in hex strings
* Thu May 06 2021 Ferdinand Thiessen <>
  - Update to version 4.1.0
    * New operators icontains, endswith, iendswith, startswith,
    * Accept \t escape sequence in text strings.
    * Add --no-follow-links command-line option to yara.
    * Prevent yara from following links to "."
    * Implemented non-blocking scanning API
    * When a string causes too many matches, YARA raises a warning
      instead of failing
    * BUGFIX: The use of --timeout could hang yara when scanning
      directories or lists of files
    * BUGFIX: Incorrect parsing of PE certificates
    * BUGFIX: Short-circuit evaluation not working fine with
      undefined expressions
  - Drop yara-fix-arm.patch, upstream merged
* Mon Feb 08 2021 Dirk Müller <>
  - update to 4.0.5:
    * Fix bug in "macho" module introduced in v4.0.4.
* Fri Jan 29 2021 Dirk Müller <>
  - update to 4.0.4:
    * Multiple out-of-bounds read in "dotnet" module.
    * Multiple out-of-bounds reads in "macho" module.
* Tue Sep 15 2020 Guillaume GARDET <>
  - Backport upstream patch to fix a segfault on ARM:
    * yara-fix-arm.patch
* Mon Aug 17 2020 Dirk Mueller <>
  - Update to 4.0.2:
    - BUGFIX: Use-after-free bug in PE module (#1287).
    - BUGFIX: Incorrect errors in rules when a single rule is badly
      formatted (#1294).
    - BUGFIX: Assertion failed with rules that have invalid syntax
    - BUGFIX: Integer overflow causing missed matches on files larger
      than 2GB (#1304).
    - BUGFIX: Crashes in Mac OS while scanning binaries with a
      signature that can't be verified (#1309).
  - Update to 4.0.1:
    - Update sandboxed API (#1276)
    - BUGFIX: Fix regression in exports parsing in PE module
    - BUGFIX: Fix unaligned accesses in ARM (e1654ae)
  - Update to 4.0.0:
    - New string modifiers base64 and base64wide (#1185).
    - New string modifier private (#1096)
    - Iterators for dictionaries and arrays (#1141).
    - Multiple API changes.
    - Memory footprint greatly reduced, specially when compiling
      large numbers of rules.
    - New commmand-line option --scan-list (#1261).
    - Added pdb_path field to "pe" module.
    - Added export_details array to "pe" module.
    - Added exports_index functions to "pe" module.
    - Improvements to "cuckoo" module.
    - BUGFIX: PE files with multiple signatures are parsed correctly
    - BUGFIX: Fix PE rich header parsing (#1164).
    - BUGFIX: Buffer overruns in "dotnet" module (#1167, #1173).
  - Bump .so version
  - Update to 3.11.0:
    - Duplicated string modifiers are now an error.
    - More flexible “xor” modifier.
    - Implement “private” strings (#1096)
    - Add “field_offsets” to “dotnet” module.
    - Implement “crc32” functions in “hash” module.
    - Improvements to “rich_signature” functions in “pe” module.
    - Implement sandboxed API using SAPI
    - BUGFIX: Some regexp character classes not matching correctly
      when used with “nocase” modifier (#1117)
    - BUGFIX: Reduce the number of ERROR_TOO_MANY_RE_FIBERS errors
      for certain hex pattern containing large jumps (#1107)
    - BUGFIX: Buffer overrun in “dotnet” module (#1108)
    - BUGFIX: Segfault in certain Windows versions (#1068)
    - BUGFIX: Memory leak while attaching to a process fails (#1070)
  - Update to 3.10.0:
    - Optimize integer range loops by exiting earlier when possible.
    - Cache the result of PE module’s imphash function in order to
      improve performance.
    - Harden virtual machine against malicious code.
    - BUGFIX: “xor” modifier not working as expected if not
      accompanied by “ascii” (#1053).
    - BUGFIX: \s and \S character classes in regular expressions now
      include vertical tab, new line, carriage return and form feed
    - BUGFIX: Regression bug in hex strings containing wildcards
    - BUGFIX: Buffer overrun in “elf” module.
    - BUGFIX: Buffer overrun in “dotnet” module.
  - Update to 3.9.0:
    - Improve scan performance for certain strings.
    - Reduce stack usage.
    - Prevent inadvertent use of compiled rules by forcing the use of
    - C when using yara command-line tool.
    - BUGFIX: Buffer overflow in "dotnet" module.
    - BUGFIX: Internal error when running multiple instances of YARA
      in Mac OS X. (#945)
    - BUGFIX: Regexp regression when using nested quantifiers {x,y}
      for certain values of x and y. (#1018)
    - BUGFIX: High RAM consumption in "pe" module while parsing
      certain files.(0c8b461)
    - BUGFIX: Denial of service when using "dex" module. Found by the
      Cisco Talos team. (#1023)
    - BUGFIX: Issues with comments inside hex strings.
  - Update to 3.8.1:
    - BUGFIX: Some combinations of boolean command-line flags were
      broken in version 3.8.0.
    - BUGFIX: While reporting errors that occur at the end of the
      file, the file name appeared as null.
    - BUGFIX: dex module now works in big-endian architectures.
    - BUGFIX: Keep ABI compatibility by keeping deprecated functions
  - Update to 3.8.0:
    - Scanner API
    - New “xor” modifier for strings
    - New fields and functions in PE module.
    - Add functions “min” and “max” to math module.
    - Make compiled.
    - yara and yaracsupport reading rules from stdin by using - as
      the file name.
    - Rule compilation is faster.
    - BUGFIX: Regression in regex engine. /ba{3}b/ was matching
    - BUGFIX: Function yr_compiler_add_fd() was reading only the
      first 1024 bytes of the file.
    - BUGFIX: Wrong calculation of sha256 hashes in Windows when
      using native crypto API.
    - Lots of more bug fixes.
* Tue May 22 2018
  - Update to 3.7.1:
    * Fix regression in include directive (issue #796)
    * Fix bug in PE checksum calculation causing wrong results in some cases.
    * time module (Wesley Shields)
    * yara command-line tool now accept multiple rule files
    * Allow a configurable limit for the number of strings per rule (option --max-strings-per-rule)
    * Implement integrity check for compiled rules
    * Implement API for customizingimport statement (@edhoedt)
    * Scan process memory in FreeBSD and OpenBDS (Hilko Bengen)
    * BUGFIX: Negated character classes not working with case-insensitive regexps (#765)
    * BUGFIX: Multiple bugs while parsing ELF files (Nate Rosenblum)
    * BUGFIX: Out-of-bounds access while parsing PE files.
    * BUGFIX: Memory leaks while parsing invalid rules.
    * BUGFIX: Heap overflow (4a342f0)
    * BUGFIX: Off-by-one NULL write in stack buffer (964d6c0)
    * BUGFIX: Multiple issues in "dotnet" module (f40c14c, fc35e5f)
    * Increase RE_MAX_AST_LEVELS from 2000 to 6000.
    * BUGFIX: Buffer overrun in regexp engine (issue #678)
    * BUGFIX: Null pointer dereference in regexp engine (issue #682).
  - Run testsuite
* Tue Jun 06 2017
  - update to v3.6.1
    * BUGFIX: Stack overflow caused by uncontrolled recursiveness (CVE-2017-9304)
    * BUGFIX: pe.overlay.size was undefined if the PE didn't have an overlay. Now it's set to 0 in those cases.
    * BUGFIX: Fix initalization issue that could cause a crash if rules compiled with a 32bit yarac is used with a 64bit yara.
  - update to v3.6.0
    * .NET module (Wesley Shields)
    * New features for ELF module (Jacob Baines)
    * Fix endianness issues (Hilko Bengen)
    * Function yr_compiler_add_fd added to libyara
    * MAX_THREADS limit can be arbitrarily increased (Emerson R. Wiley)
    * Added --fail-on-warnings command-line option
    * Multiple bug fixes:
    CVE-2016-10210, CVE-2016-10211, CVE-2017-5923, CVE-2017-5924,
    CVE-2017-8294, CVE-2017-8929, CVE-2017-9438
* Sat Nov 12 2016
  - Add pkg-config to ensure .pc autodetection is always in effect
* Fri Sep 30 2016
  - update to v3.5.0
    * Match length operator (
    * Performance improvements
    * Less memory consumption while scanning processes
    * Exception handling when scanning memory blocks
    * Negative integers in meta fields
    * Added the --stack-size command-argument
    * Functions import_ordinal, is_dll, is_32bit and is_64bit added to PE module
    * Functions rich_signature.toolid and rich_signature.version added to PE module
    * Lots of bug fixes
  - upstream moved python-yara into a separate project.  Do the same.
  - python-plaso now requires python-yana >= v3.5.0
  - add BuildRequires: pkg-config as documented in the openSUSE packaging guidelines
* Thu Jul 23 2015
  - add yara.pc to the libyara subpackage
  - remove sed command previously needed to properly link Yara and libyara.  No longer needed with latest upstream source.
  - update to v3.4.0
    * Short-circuit evaluation for conditions
    * New yr_rules_save_stream/yr_rules_load_stream APIs.
    * load() and save() methods in yara-python accept file-like objects
    * Improvements to the PE and ELF modules
    * Some performance improvements
    * New command-line option --print-module-data
    * Multiple bug fixes.
  - v3.3.0
    * Added support for negative integers and floating point numbers
    * Implemented operators >,<, >=, <= for strings
    * Implemented word boundary anchors (\b, \B) in regular expressions
    * New features in PE module
    * Math module
    * New --print-namespace command line argument
    * Better error handling in low memory conditions
    * BUGFIX: "at" operator not working with certain strings containing wildcards
    * BUGFIX: precedence of bitwise operators was incorrect
    * BUGFIX: incorrect imphash result for certain PE files importing functions by ordinal
    * BUGFIX: handle and memory leaks
    * BUGFIX: multiple segfaults
  - v3.2.0
    * ELF module
    * Hash module
    * New features in PE module
    * Big-endian version of intXX and uintXX functions
    * Modules can declare dictionary objects
    * Modules accept overloaded functions
    * Performance improvements
    * BUGFIX: "and" operator not working properly with integer operands
    * BUGFIX: False positive with strings declared as "fullword wide ascii"
    * BUGFIX: False positive with "wide fullword" strings shorter than 5 bytes
    * BUGFIX: Functions declared in a structure array not working properly
    * BUGFIX: "contains" operator causing segfault if operand is an undefined string
* Fri Sep 26 2014
  - split off a -doc sub-project
* Wed Sep 24 2014
  - update to v3.1.0
    * Yara now supports plugin modules
    * Numerous major improvements.  See in the documentation folder for details
  - update License to Apache 2.0
  - build with cuckoo and magic modules (cuckoo only for factory and newer)
  - major specfile cleanup
    * add soname as a variable and use it appropriately
    * add /usr/bin/yarac and associated man file
    * update Url and Source fields
    * add libtool build requirement
    * delete no longer needed patch, now upstream: yara-fixes.patch
    * add ./ call to %build section as recommended by upstream
    * add +%{_includedir}/yara to -devel since it is full of yara related header files
    * use default naming for devel sub-project
    * remove *.a and *.la files from the devel sub-project
    * incorporate python-yara as a sub-project
* Wed Feb 15 2012
  - Release should have a value of zero in OBS.  It is handled automatically via OBS.
* Mon Feb 13 2012
  - use %{__make} macro
* Thu Feb 09 2012
  - built with default compile flags, fixed 2 small issues
* Tue Feb 07 2012
  - Initial submission
    A malware identification and classification tool



Generated by rpm2html 1.8.1

Fabrice Bellet, Fri May 20 00:18:26 2022