GLSA Advocate
Joined: 12 May 2004 Posts: 2663
|
Posted: Tue Mar 18, 2008 12:26 am Post subject: [ GLSA 200803-24 ] PCRE: Buffer overflow |
|
|
Gentoo Linux Security Advisory
Title: PCRE: Buffer overflow (GLSA 200803-24)
Severity: high
Exploitable: remote
Date: March 17, 2008
Bug(s): #209067, #209293
ID: 200803-24
Synopsis
A buffer overflow vulnerability has been discovered in PCRE, allowing for the execution of arbitrary code and Denial of Service.
Background
PCRE is a Perl-compatible regular expression library. GLib includes a copy of PCRE.
Affected Packages
Package: dev-libs/libpcre
Vulnerable: < 7.6-r1
Unaffected: >= 7.6-r1
Architectures: All supported architectures
Package: dev-libs/glib
Vulnerable: < 2.14.6
Unaffected: >= 2.14.6
Unaffected: < 2.14.0
Architectures: All supported architectures
Description
PCRE contains a buffer overflow vulnerability when processing a character class containing a very large number of characters with codepoints greater than 255.
Impact
A remote attacker could exploit this vulnerability by sending a specially crafted regular expression to an application making use of the PCRE library, which could possibly lead to the execution of arbitrary code or a Denial of Service.
Workaround
There is no known workaround at this time.
Resolution
All PCRE users should upgrade to the latest version: Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-libs/libpcre-7.6-r1" | All GLib users should upgrade to the latest version: Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-libs/glib-2.14.6" |
References
CVE-2008-0674
Last edited by GLSA on Tue Mar 18, 2008 4:20 am; edited 1 time in total |
|