[ GLSA 200807-03 ] PCRE: Buffer overflow

[GLSA]

Gentoo Linux Security Advisory

Title: PCRE: Buffer overflow (GLSA 200807-03)
Severity: high
Exploitable: remote
Date: July 07, 2008
Bug(s): #228091, #230039
ID: 200807-03

Synopsis

A buffer overflow vulnerability has been discovered in PCRE, allowing for the execution of arbitrary code and a Denial of Service.

Background

PCRE is a Perl-compatible regular expression library. GLib includes a copy of PCRE.

Affected Packages

Package: dev-libs/libpcre
Vulnerable: < 7.7-r1
Unaffected: >= 7.7-r1
Architectures: All supported architectures

Package: dev-libs/glib
Vulnerable: < 2.16.3-r1
Unaffected: >= 2.16.3-r1
Unaffected: < 2.14.0
Architectures: All supported architectures


Description

Tavis Ormandy of the Google Security team reported a heap-based buffer overflow when compiling regular expression patterns containing "Internal Option Settings" such as " (?i) ".

Impact

A remote attacker could exploit this vulnerability by sending a specially crafted regular expression to an application making use of the PCRE library, which could possibly lead to the execution of arbitrary code or a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All PCRE users should upgrade to the latest version: