Red Hat Security AdvisoryRHSA-2016:1025
pcre security update
Released 2016-05-11 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) pcre-8.32-15.el7_2.1
- Red Hat Enterprise Linux Client Optional (v. 7) pcre-devel-8.32-15.el7_2.1, pcre-static-8.32-15.el7_2.1, pcre-tools-8.32-15.el7_2.1
- Red Hat Enterprise Linux ComputeNode (v. 7) pcre-8.32-15.el7_2.1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) pcre-devel-8.32-15.el7_2.1, pcre-static-8.32-15.el7_2.1, pcre-tools-8.32-15.el7_2.1
- Red Hat Enterprise Linux Server (v. 7) pcre-8.32-15.el7_2.1, pcre-8.32-15.el7_2.1.ppc, pcre-devel-8.32-15.el7_2.1 +1
- Red Hat Enterprise Linux Server Optional (v. 7) pcre-static-8.32-15.el7_2.1, pcre-static-8.32-15.el7_2.1.ppc, pcre-tools-8.32-15.el7_2.1
- Red Hat Enterprise Linux Workstation (v. 7) pcre-8.32-15.el7_2.1, pcre-devel-8.32-15.el7_2.1
- Red Hat Enterprise Linux Workstation Optional (v. 7) pcre-static-8.32-15.el7_2.1, pcre-tools-8.32-15.el7_2.1
Fixes 8 records
Priority MEDIUM 53
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows r…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0843 · Published 2016-03-17 · Partial fix CWE-119
Priority MEDIUM 52
PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other imp…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0687 · Published 2015-12-02 · Partial fix CWE-119
Priority MEDIUM 51
The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06404 · Published 2015-12-02 · Partial fix CWE-119
Priority MEDIUM 50
Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly…
CVSS 3.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.07673 · Published 2016-12-13 · Partial fix CWE-119
Priority MEDIUM 42
PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.06587 · Published 2015-12-02 · Partial fix CWE-119
Priority MEDIUM 42
PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrat…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.06169 · Published 2016-12-13 · Partial fix CWE-119
Priority MEDIUM 41
PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecifi…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.05623 · Published 2015-12-02 · Partial fix CWE-119
Priority MEDIUM 41
PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other im…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.05244 · Published 2015-12-02 · Partial fix CWE-19
THREATIST.IORead the docs