CVE-2006-7225: Input Validation
From pcre changelog, version 6.7:
18. A valid (though odd) pattern that looked like a POSIX character class but used an invalid character after [ (for example [[,abc,]]) caused pcrecompile() to give the error "Failed: internal error: code overflow" or in some cases to crash with a glibc free() error. This could even happen if the pattern terminated after [[ but there just happened to be a sequence of letters, a binary zero, and a closing ] in the memory that followed.
Acknowledgements:
Red Hat would like to thank Ludwig Nussel for reporting this issue.
Other sources
Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to cause a denial of service (error or crash) via a regular expression that involves a "malformed POSIX character class", as demonstrated via an invalid character after a [[ sequence.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-7225?
CVE-2006-7225 is classified as a critical vulnerability due to its potential to cause application crashes.
How does CVE-2006-7225 affect PCRE versions?
CVE-2006-7225 affects multiple versions of PCRE, specifically 0.91 through 6.7.
What types of applications are impacted by CVE-2006-7225?
Applications using the affected versions of PCRE for regular expression handling may crash or exhibit errors.
How do I fix CVE-2006-7225?
To fix CVE-2006-7225, upgrade to a version of PCRE that is not affected, ideally version 6.8 or greater.
What causes the vulnerabilities in CVE-2006-7225?
The vulnerabilities in CVE-2006-7225 are caused by improper handling of invalid character classes in regular expressions.