YARA v4.5.8

• Document the YR_RE_SCAN_LIMIT regular expression scan limit (#2223).
• BUGFIX: Bound rule table index in OP_PUSH_RULE and OP_INIT_RULE (#2230).
• BUGFIX: Bound tilde stream row-count read in dotnet module (#2224).
• BUGFIX: Bound repeat stack depth in _yr_re_fiber_sync (#2229).
• BUGFIX: Fix memory leak in yr_rules_load_stream (e13acd3).
• BUGFIX: Add missing yr_le16toh byte-swapping in pe module (a2ff0db).
• BUGFIX: Validate summary counts in yr_rules_from_arena (#2222).
• BUGFIX: Cast e_lfanew to int32_t before sign check in pe_get_header (#2228).
• BUGFIX: Bound export name count against 32-bit overflow in pe_parse_exports (#2227).
• BUGFIX: Null-terminate authenticode digest/thumbprint hex buffers in pe module (#2221).
• BUGFIX: Fix string memory leak in CLI args_free (#2220).
• BUGFIX: Honor -w/--no-warnings for the file-too-large skip message in CLI (#2219).
• BUGFIX: Avoid pointer wrap for large index in str_table_entry (#2217).
• BUGFIX: Bound iterator item count against value stack depth in yr_execute_code (#2216).
• BUGFIX: Byte-swap sh_entry_count in ELF symtab/dynsym link check (#2214).
• BUGFIX: Validate relocation target reference buffer ID and offset in yr_arena_load_stream (#2213).
• BUGFIX: Fix INT64_MIN undefined behavior in grammar constant folding (*, \, unary -) (#2211).
• BUGFIX: Fix HWASan trap due to unaligned access in arena relocation (#2215).
• BUGFIX: Bound relocation read by reference size in yr_arena_load_stream (#2212).
• BUGFIX: Harden PE delayed import parser and dotnet blob stream parsing (#2201).
• BUGFIX: Enable split ID bounds check in _yr_re_fiber_sync (#2208).
• BUGFIX: Bound fat architecture count against integer overflow in macho module (#2209).
• BUGFIX: Read dotnet and pe file fields through unaligned access helpers (#2210).
• BUGFIX: Remove double byte-swap of NumberOfNames in pe_parse_exports (#2206).
• BUGFIX: Check relocation buffer_id before dereference in yr_arena_load_stream (#2202).
• BUGFIX: Cast character inputs to unsigned char before ctype calls in pe and elf parsers (#2203).
• BUGFIX: Avoid unaligned pointer casts in arena operations to prevent HWASan traps (#2204).
• BUGFIX: Bound DEX ID table reads against file size in dex module (#2205).
• BUGFIX: Fix build issues with OpenSSL 4.0 (#2233).

Contributors: @cblichmann @jmestwa-coder @munzzyy @q1930893235 @TristanInSec @wazeer

YARA v4.5.7

• BUGFIX: Guard against undersized rich header in while parsing PE files (#2200).
• BUGFIX: Abort the collection of resources in pe module when MAX_RESOURCES is reached (9d09369).

YARA v4.5.6

• BUGFIX: Out of bounds read while parsing .NET files (#2196).
• BUGFIX: Make yr_string_set_destroy non-public (#2191).

YARA v4.5.5

• Implement the --no-follow-symlinks option in Windows (6e11b5a).
• BUGFIX: Revert YR_RE_SCAN_LIMIT back to 4096 (#2177).
• BUGFIX: infinite loop while parsing corrupt resource directory in PE module (#2162).
• BUGFIX: improved detection whether a string requires all matches (#2167).
• BUGFIX: Heap overflow while loading hand-crafted compiled rules (#2178). Thanks to Momoko Shiraishi
  for the report.

Contributors: @secDre4mer @PeterMatula @wxsBSD

YARA v4.5.4

• BUGFIX: update version number (version 4.5.3 was incorrectly labeled 4.5.2)

YARA v4.5.3

• BUGFIX: Escape new new and carriage return characters when printing file paths (credits to: Rajesh Pangare).
• BUGFIX: Avoid infinite loop while iterating Mach-O regions.
• BUGFIX: High memory consumption while parsing corrupted PE files.
• BUGFIX: Issue while parsing imports in 32-bits PE files.
• BUGFIX: Integer overflow while parsing ELF files.

Contributors: @gremat, @roblabla, @shanehuntley, @wxsBSD

YARA v4.5.2

• Increase the limit for the maximum number of rows in dotnet module (608fb3d).
• Limit resource names to 1000 character at most (3f5b4c7).
• Recover from syntax error at the end of an included file (4fc1ff8).
• BUGFIX: Crash while parsing PE Rich headers with certain files (cbc982d).
• BUGFIX: Segfault with regular expressions that matched the zero-length string (8616165).
• BUGFIX: Mitigate stack overflow when scanning very deep directory trees (2a9f61d).
• BUGFIX: Fix regression introduced in 6209630 (44fd094).

YARA v4.5.1

• Allow spaces in regexp repetition operators (e.g: {n, m}).
• BUGFIX: matches operator was not matching empty strings (c80cd9d).
• BUGFIX: Several bugs in array type handling in dotnet module (#2064).
• BUGFIX: Fix issue while parsing .NET files (5bf72f2).
• BUGFIX: Fix issues while parsing PE resources (c009195, 4793b49).
• BUGFIX: Infinite loop while parsing corrupt PE files (e453eb1).
• BUGFIX: OOM errors while parsing corrupt PE files (4b9b4c0, 1be9811).
• BUGFIX: Build issue in Alpine Linux due to pread64 not found (#2050).
• BUGFIX: Issue while parsing rich header in some PE files (4793b49).

YARA v4.5.0

• Unreferenced strings are allowed if their identifier start with _ (#1941)
• New command-line option --disable-console-logs for disabling the output of the console module (#1915)
• New command-line option --strict-escape that raises warnings on unknown escape sequences (#1880).
• Improve performance by avoiding the execution of rule conditions that can't match (#1927)
• Add callback message CALLBACK_MSG_TOO_SLOW_SCANNING for notifying about slow rules (#1921).
• Expose function RVA in pe.export_details(#1882).
• BUGFIX: Fix issues in the computation of imphash in pe module (#1944). Credits to the NSHC ThreatRecon team!
  BUGFIX: Fix multiple out-of-bound memory reads in dex module (#1949, #1951).
• BUGFIX: Fix memory alignment issues (#1930).
• BUGFIX: Some strings with the wide and ascii modifiers not matching as they should (#1933).
• BUGFIX: Some rules not matching when --fast-scan is used (4de3d57)
• BUGFIX: Properly list memory regions while scanning processes in Mac OS. (#2033)
• BUGFIX: RFC5652 countersignatures are now correctly parsed in pe module (#2034)
• BUGFIX: Fix potential DoS due to crashes in authenticode parser with malformed files (#2034) CVE-2024-26364. Credits to Bahaa Naamneh!
• BUGFIX: Fix SIGSEGV in magic module when libmagic returns null pointer (3342aa0)
• BUGFIX: Prevent infinite recursion while following symlinks (923368e)

Thanks to: @mgoffin, @wxsBSD, @cblichmann, @secDre4mer, @vthib, @regeciovad, @kylereedmsft, @TommYDeeee, @humpalum, @metthal

YARA v4.4.0

fix: If any signature is valid, the file is properly signed (#1936)