PT-2005-5573 · Pcre · Libpcre3-Dev+9

Published 1970-01-01 · Updated 2018-10-15 · CVE-2007-4767

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libpcrecpp0 versions (affected versions not specified) libpcre3 versions (affected versions not specified) libpcre versions prior to 7.3-r1 pcre-32bit versions (affected versions not specified) pcregrep versions (affected versions not specified) pcre versions (affected versions not specified) libpcre3-dev versions (affected versions not specified) pgrep versions (affected versions not specified) pcre-devel versions (affected versions not specified) Perl-Compatible Regular Expression (PCRE) library versions prior to 7.3

Description The issue concerns multiple vulnerabilities in the PCRE library, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely, potentially causing a denial of service or allowing the execution of arbitrary code. The vulnerabilities are related to the improper computation of the length of certain sequences, including p, P, and P{x} sequences.

Recommendations For libpcrecpp0, update to a version that addresses the vulnerabilities. For libpcre3, update to a version that addresses the vulnerabilities. For libpcre, update to version 7.3-r1 or later. For pcre-32bit, update to a version that addresses the vulnerabilities. For pcregrep, update to a version that addresses the vulnerabilities. For pcre, update to a version that addresses the vulnerabilities. For libpcre3-dev, update to a version that addresses the vulnerabilities. For pgrep, update to a version that addresses the vulnerabilities. For pcre-devel, update to a version that addresses the vulnerabilities. For Perl-Compatible Regular Expression (PCRE) library, update to version 7.3 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-189

Related Identifiers

BDU:2015-02588

BDU:2015-02589

BDU:2015-02590

BDU:2015-02591

BDU:2015-03061

BDU:2015-04723

BDU:2015-04724

BDU:2015-04725

BDU:2015-09569

CVE-2007-4767

DSA-1399-1

DSA-1570-1

DTSA-77-1

Affected Products

Pcre Library

Libpcre

Libpcre3

Libpcre3-Dev

Libpcrecpp0

Pcre

Pcre-32Bit

Pcre-Devel

Pcregrep

Pgrep

References · 66

• https://bdu.fstec.ru/vul/2015-02590 · Security Note
• http://security.gentoo.org/glsa/glsa-200711-30.xml · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200805-11.xml · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1662 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4767 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00181.html · Vendor Advisory
• http://debian.org/security/2008/dsa-1570 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09569 · Security Note
• https://bdu.fstec.ru/vul/2015-04724 · Security Note
• https://bdu.fstec.ru/vul/2015-02591 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1660 · Security Note
• https://osv.dev/vulnerability/CVE-2007-4767 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03061 · Security Note
• http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html · Vendor Advisory