CVE-2017-7186: Buffer Overflow
A vulnerability was found in pcre caused by trying to find a Unicode property for a code value greater than 0x10ffff, the Unicode maximum, when running in non-UTF mode (where character values can be up to 0xffffffff).
Upstream bug:
https://bugs.exim.org/showbug.cgi?id=2052
References:
https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-match-pcreexec-c/
Upstream patches (pcre):
https://vcs.pcre.org/pcre?view=revision&revision=1688
Upstream patches (pcre2):
https://vcs.pcre.org/pcre2?view=revision&revision=670
Other sources
libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pcreto a version that resolves this vulnerability.Fixed in 8.41 - Upgrade
Upgrade
redhat/pcre2to a version that resolves this vulnerability.Fixed in 10.24 - Upgrade
Upgrade
libpcre1 (PCRE 8)to a version that resolves this vulnerability.Fixed in 8.40 - Upgrade
Upgrade
libpcre2 (PCRE2)to a version that resolves this vulnerability.Fixed in 10.23
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7186?
CVE-2017-7186 is considered to have a high severity due to its potential to cause denial of service through application crashes.
How do I fix CVE-2017-7186?
To fix CVE-2017-7186, upgrade to PCRE version 8.41 or PCRE2 version 10.24.
Who is affected by CVE-2017-7186?
CVE-2017-7186 affects users of PCRE version 8.40 and PCRE2 version 10.23.
What is the impact of CVE-2017-7186?
The impact of CVE-2017-7186 includes application crashes due to invalid Unicode property lookups.
Can CVE-2017-7186 be exploited remotely?
Yes, CVE-2017-7186 can be exploited remotely, leading to denial of service.