CVE-2017-16231: Buffer Overflow
First published: Sun Mar 17 2019(Updated: )
** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pcre Pcre | =8.41 | |
| =8.41 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/150897/PCRE-8.41-Buffer-Overflow.html
- http://seclists.org/fulldisclosure/2018/Dec/33
- http://www.openwall.com/lists/oss-security/2017/11/01/11
- http://www.openwall.com/lists/oss-security/2017/11/01/3
- http://www.openwall.com/lists/oss-security/2017/11/01/7
- http://www.openwall.com/lists/oss-security/2017/11/01/8
- http://www.securityfocus.com/bid/101688
- https://bugs.exim.org/show_bug.cgi?id=2047
Frequently Asked Questions
What is the severity of CVE-2017-16231?
The severity of CVE-2017-16231 is medium with a severity value of 5.5.
What is the affected software of CVE-2017-16231?
The affected software of CVE-2017-16231 is PCRE version 8.41.
How does CVE-2017-16231 occur?
CVE-2017-16231 occurs due to a crash overflow in the function match() in pcre_exec.c, caused by a self-recursive call.
Is CVE-2017-16231 disputed?
Yes, CVE-2017-16231 is disputed by third parties who argue that there are options available to limit the impact.
Are there any references available for CVE-2017-16231?
Yes, there are references available for CVE-2017-16231 which include: http://packetstormsecurity.com/files/150897/PCRE-8.41-Buffer-Overflow.html, http://seclists.org/fulldisclosure/2018/Dec/33, and http://www.openwall.com/lists/oss-security/2017/11/01/11.
- collector/nvd-index
- agent/references
- agent/type
- agent/severity
- agent/weakness
- agent/author
- agent/status
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- status/disputed
- vendor/pcre
- canonical/pcre pcre
- version/pcre pcre/8.41