Buffer overflow in Pcre
CVE-2008-2371
Heap-based buffer overflow in pcre_compile.c in the Perl-Compatible Regular Expression (PCRE) library 7.7 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a regular expression that begins with an option and contains multiple branches.
Vulnerability class: Buffer Overflow
EPSS: 0.067 (93.2th percentile) — read the EPSS interpretation.
Affected products
- Pcre — versions 7.7
- Php
- Canonical Ubuntu_linux — versions 6.06, 7.04, 7.10
- Debian Debian_linux — versions 4.0
- Fedoraproject Fedora — versions 8, 9
- Opensuse — versions 10.3
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (Permissions Required, Third Party Advisory, vdb-entry, x_refsource_VUPEN)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_MANDRIVA, Broken Link)
- secalert@redhat.com (x_refsource_SECUNIA, Not Applicable, third-party-advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Exploit, Issue Tracking)
- secalert@redhat.com (x_refsource_HP, vendor-advisory, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
- secalert@redhat.com (Permissions Required, Third Party Advisory, vdb-entry, x_refsource_VUPEN)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
- secalert@redhat.com (x_refsource_HP, vendor-advisory, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)