CVE-2017-7245: Input Validation
A stack-based buffer overflow flaw was found in PCRE. An attacker could use a crafted file that, when processed by PCRE, would crash the application using the PCRE library.
This issue only affects the PCRE version 8.40.
Other sources
Stack-based buffer overflow in the pcre32copysubstring function in pcreget.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PCRE / libpcre1to a version that resolves this vulnerability.Fixed in 8.40 - Compensating control
Mitigate denial-of-service risk by preventing untrusted/remote crafted files from being processed by applications that use the PCRE library (e.g., block or restrict file sources before PCRE processing).
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7245?
CVE-2017-7245 has a high severity rating due to its potential to cause application crashes.
How do I fix CVE-2017-7245?
To fix CVE-2017-7245, upgrade PCRE to the latest version beyond 8.40 to mitigate the buffer overflow vulnerability.
Which version of PCRE is affected by CVE-2017-7245?
CVE-2017-7245 specifically affects PCRE version 8.40.
What kind of vulnerability is CVE-2017-7245?
CVE-2017-7245 is classified as a stack-based buffer overflow vulnerability.
What are the potential consequences of CVE-2017-7245?
The potential consequences of CVE-2017-7245 include application crashes and possible exploitation by attackers.