CVE-2006-7227: Buffer Overflow
CVE-2006-7224 initially described several integer overflows in pcre, all described here: http://scary.beasts.org/security/CESA-2007-006.html
This id should be used to describe issue #1 in that advisory:
1) Integer overflow leading to buffer overflow.
pcrecompile: --- / Compute the size of data block needed and get it, either from malloc or externally provided function. /
size = length + sizeof(realpcre) + namecount (maxnamesize + 3); re = (realpcre )(pcremalloc)(size); ---
Unfortunately, a malicious regex can easily cause large "namecount" and "maxnamesize" such that this calculation overflows. Demo:
(?P)(?P<0>)(?P<1>)...fill in this sequence...(?P<4293>)
Other sources
Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (namecount) or long subpattern names (maxnamesize), which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-7227?
CVE-2006-7227 is classified as a high-severity vulnerability due to the integer overflow issues in PCRE.
How do I fix CVE-2006-7227?
To fix CVE-2006-7227, update the pcre package to versions 0:4.5-4.el4_5.4 or 0:6.6-2.el5_1.1.
Which versions of PCRE are affected by CVE-2006-7227?
Versions of PCRE up to and including 6.6 are affected by CVE-2006-7227.
What type of vulnerability is CVE-2006-7227?
CVE-2006-7227 is an integer overflow vulnerability that can lead to potential code execution.
Is CVE-2006-7227 remote exploitable?
CVE-2006-7227 may be remotely exploitable depending on how the PCRE library is used in applications.