PT-2005-3395 · Python+5 · Python+5

Published 2005-08-01 · Updated 2024-02-14 · CVE-2005-2491

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PCRE versions prior to 6.2 Apache HTTP Server (affected versions not specified)

Description The issue is related to an integer overflow in the pcre compile.c file of the Perl Compatible Regular Expressions (PCRE) library, which can be exploited to execute arbitrary code via quantifier values in regular expressions. This leads to a heap-based buffer overflow. The PCRE library is used in multiple products, including Python, Ethereal, and PHP.

Recommendations For PCRE versions prior to 6.2, update to version 6.2 or later to resolve the issue. For Apache HTTP Server, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-2491

DSA-800-1

DSA-817-1

DSA-819-1

DSA-821-1

DTSA-10-1

RHSA-2005:358

RHSA-2005:761

RHSA-2005_358

RHSA-2005_761

RHSA-2006:0197

RHSA-2006_0197

Affected Products

Apache Http Server

Ethereal

Pcre

Php

Python

Red Hat

References · 77

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0197.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=112606064317223&w=2 · Vendor Advisory
• http://debian.org/security/2005/dsa-800 · Vendor Advisory
• http://docs.info.apple.com/article.html?artnum=302847 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-358.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-2491 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200509-02.xml · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200509-19.xml · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-2491 · Vendor Advisory
• http://debian.org/security/2005/dsa-821 · Vendor Advisory
• http://securitytracker.com/id?1014744 · Patch
• http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522 · Vendor Advisory
• http://securityfocus.com/archive/1/427046/100/0/threaded · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2491 · Security Note