Description
Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate the amount of memory needed for a compiled regular expression pattern when the (1) -x or (2) -i UTF-8 options change within the pattern, which allows context-dependent attackers to cause a denial of service (PCRE or glibc crash) via crafted regular expressions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://secunia.com/advisories/30219 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=384801 ↗
- http://security.gentoo.org/glsa/glsa-200711-30.xml ↗
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:030 ↗
- http://www.debian.org/security/2008/dsa-1570 ↗
- http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html ↗
- http://secunia.com/advisories/28658 ↗
- http://secunia.com/advisories/27773 ↗
- http://secunia.com/advisories/28406 ↗
- http://support.avaya.com/elmodocs2/security/ASA-2007-505.htm ↗
- http://www.redhat.com/support/errata/RHSA-2007-1068.html ↗
- http://security.gentoo.org/glsa/glsa-200805-11.xml ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10911 ↗
- http://www.redhat.com/support/errata/RHSA-2007-1059.html ↗
- http://www.securityfocus.com/bid/26550 ↗
- http://secunia.com/advisories/28041 ↗
- http://secunia.com/advisories/27741 ↗
- http://www.novell.com/linux/security/advisories/2007_62_pcre.html ↗
- http://www.pcre.org/changelog.txt ↗
- http://secunia.com/advisories/30155 ↗
- http://secunia.com/advisories/28720 ↗
- http://security.gentoo.org/glsa/glsa-200801-02.xml ↗
- http://bugs.gentoo.org/show_bug.cgi?id=198976 ↗
- http://security.gentoo.org/glsa/glsa-200801-19.xml ↗
- http://security.gentoo.org/glsa/glsa-200801-18.xml ↗
- http://secunia.com/advisories/28414 ↗
- http://secunia.com/advisories/30106 ↗
- http://secunia.com/advisories/28714 ↗