CVE-2014-8964: Buffer Overflow
Heap buffer overflow issue was reported in PCRE when processing a specially crafted regular expressions: http://bugs.exim.org/showbug.cgi?id=1546
Upstream patch for this: http://www.exim.org/viewvc/pcre2?view=rev&revision=154
The next upstream release that will contain the above fix is likely to be around Feb/Mar next year (2015).
Other sources
Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows zero repeats.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8964?
CVE-2014-8964 is classified as a high severity vulnerability due to the potential for arbitrary code execution from a heap buffer overflow.
How do I fix CVE-2014-8964?
To fix CVE-2014-8964, update PCRE to version 8.37 or later.
What platforms are affected by CVE-2014-8964?
CVE-2014-8964 affects various versions of PCRE across multiple platforms including Red Hat, Fedora, OpenSUSE, and Oracle Solaris.
What type of vulnerability is CVE-2014-8964?
CVE-2014-8964 is a heap buffer overflow vulnerability that occurs when processing specially crafted regular expressions.
Who reported CVE-2014-8964?
CVE-2014-8964 was reported through the Exim bug tracking system.