GLSA Advocate
Joined: 12 May 2004 Posts: 2663
|
Posted: Mon Jul 07, 2008 9:26 pm Post subject: [ GLSA 200807-03 ] PCRE: Buffer overflow |
|
|
Gentoo Linux Security Advisory
Title: PCRE: Buffer overflow (GLSA 200807-03)
Severity: high
Exploitable: remote
Date: July 07, 2008
Bug(s): #228091, #230039
ID: 200807-03
Synopsis
A buffer overflow vulnerability has been discovered in PCRE, allowing for
the execution of arbitrary code and a Denial of Service.
Background
PCRE is a Perl-compatible regular expression library. GLib includes a
copy of PCRE.
Affected Packages
Package: dev-libs/libpcre
Vulnerable: < 7.7-r1
Unaffected: >= 7.7-r1
Architectures: All supported architectures
Package: dev-libs/glib
Vulnerable: < 2.16.3-r1
Unaffected: >= 2.16.3-r1
Unaffected: < 2.14.0
Architectures: All supported architectures
Description
Tavis Ormandy of the Google Security team reported a heap-based buffer
overflow when compiling regular expression patterns containing
"Internal Option Settings" such as " (?i) ".
Impact
A remote attacker could exploit this vulnerability by sending a
specially crafted regular expression to an application making use of
the PCRE library, which could possibly lead to the execution of
arbitrary code or a Denial of Service.
Workaround
There is no known workaround at this time.
Resolution
All PCRE users should upgrade to the latest version:
Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-libs/libpcre-7.7-r1" |
All GLib users should upgrade to the latest version:
Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-libs/glib-2.16.3-r1" |
References
CVE-2008-2371
Last edited by GLSA on Wed Aug 21, 2013 4:27 am; edited 2 times in total |
|