Improper input validation in Perl Pcre

CVE-2006-7225

Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to cause a denial of service (error or crash) via a regular expression that involves a "malformed POSIX character class", as demonstrated via an invalid character after a [[ sequence.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.016 (73.4th percentile) — read the EPSS interpretation.

Affected products

  • Perl Pcre — versions 0.91, 0.92, 0.93
  • N/a — versions n/a

Weakness classification (CWE)

References