PT-2019-8041 · Pcre+2 · Pcre+2

Zhang Jiawang · Publicado 2018-07-12 · Atualizado 2024-08-05 · CVE-2017-16231

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PCRE version 8.41

Description The issue is related to a crash overflow in the function match() in pcre exec.c due to a self-recursive call. This occurs after compiling and running a pcretest load test proof of concept. It's worth noting that third parties have disputed the relevance of this report, suggesting that options are available to limit the amount of stack used, potentially mitigating the issue.

Recommendations For PCRE version 8.41, consider using options that limit the amount of stack used to mitigate the risk of a crash overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2018-2007

CVE-2017-16231

Produtos afetados

Alt Linux

Debian

Pcre

Referências · 16

• 🔥 http://openwall.com/lists/oss-security/2017/11/01/8 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2017/11/01/3 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16231 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16231 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2017-16231 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2018/Dec/33 · Nota
• http://openwall.com/lists/oss-security/2017/11/01/11 · Nota
• http://securityfocus.com/bid/101688 · Nota
• https://t.me/cvenotify/85140 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-16231 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2017/11/01/7 · Nota
• http://packetstormsecurity.com/files/150897/PCRE-8.41-Buffer-Overflow.html · Nota
• https://security.alpinelinux.org/vuln/CVE-2017-16231 · Nota
• https://t.me/cvenotify/85344 · Publicação no Telegram
• https://osv.dev/vulnerability/ALPINE-CVE-2017-16231 · Aviso do Fabricante