PT-2008-1119 · Boost+1 · Boost Regex Library+2
Tavis Ormandy
+1
·
Published
2008-01-17
·
Updated
2018-10-15
·
CVE-2008-0172
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Boost regex library versions 1.33 through 1.34
Boost library versions prior to 1.34.1-r2
Description
The issue allows context-dependent attackers to cause a denial of service, potentially leading to a crash, via an invalid regular expression. Multiple vulnerabilities in the Boost package can be exploited remotely, leading to disruption of protected information availability.
Recommendations
For Boost regex library versions 1.33 through 1.34, consider updating to a version later than 1.34.
For Boost library versions prior to 1.34.1-r2, update to version 1.34.1-r2 or later to resolve the issue.
As a temporary workaround, consider restricting the use of the
get repeat type function in basic regex creator.hpp until a patch is available.Fix
DoS
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Boost Library
Boost Regex Library
Red Hat