PT-2007-7494 · Pcre · Libpcre3-Dev+5

Published 1970-01-01 · Updated 2018-10-16 · CVE-2007-1662

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libpcre versions prior to 7.3 libpcre3 versions (affected versions not specified) libpcrecpp0 versions (affected versions not specified) pcregrep versions (affected versions not specified) libpcre3-dev versions (affected versions not specified) pgrep versions (affected versions not specified)

Description The issue concerns multiple vulnerabilities in the PCRE library, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely, potentially causing a denial of service (crash). The problem arises when the library reads past the end of a string while searching for unmatched brackets and parentheses, allowing context-dependent attackers to cause a crash, possibly involving forward references.

Recommendations For libpcre versions prior to 7.3, update to version 7.3 or later. For libpcre3, libpcrecpp0, pcregrep, libpcre3-dev, and pgrep, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-189

Related Identifiers

BDU:2015-02588

BDU:2015-02589

BDU:2015-02590

BDU:2015-02591

BDU:2015-03061

BDU:2015-09569

CVE-2007-1662

DSA-1399-1

DSA-1570-1

DTSA-77-1

Affected Products

Libpcre

Libpcre3

Libpcre3-Dev

Libpcrecpp0

Pcregrep

Pgrep

References · 60

• https://bdu.fstec.ru/vul/2015-02590 · Security Note
• https://bdu.fstec.ru/vul/2015-03061 · Security Note
• http://security.gentoo.org/glsa/glsa-200711-30.xml · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200805-11.xml · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02589 · Security Note
• http://security.gentoo.org/glsa/glsa-200801-19.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1662 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1661 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4766 · Security Note
• https://usn.ubuntu.com/547-1 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-1662 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4768 · Security Note
• http://security.gentoo.org/glsa/glsa-200801-02.xml · Vendor Advisory