CVE-2017-7246: Input Validation
A stack-based buffer overflow flaw was found in PCRE. An attacker could use a crafted file that, when processed by PCRE, would crash the application using the PCRE library.
This issue only affects the PCRE version 8.40.
Other sources
Stack-based buffer overflow in the pcre32copysubstring function in pcreget.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PCRE (libpcre1)to a version that resolves this vulnerability.Fixed in 8.40 - Compensating control
For systems using PCRE 8.40, block remote processing of attacker-controlled files/inputs until PCRE is updated, to prevent crashes triggered by crafted files.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7246?
CVE-2017-7246 is classified as a medium severity vulnerability due to the potential for a stack-based buffer overflow.
How do I fix CVE-2017-7246?
To fix CVE-2017-7246, upgrade to a newer version of the PCRE library that is not affected by this vulnerability.
What causes the CVE-2017-7246 vulnerability?
CVE-2017-7246 is caused by a stack-based buffer overflow in the pcre32_copy_substring function when processing crafted files.
Which version of PCRE is affected by CVE-2017-7246?
Only PCRE version 8.40 is affected by CVE-2017-7246.
What are the potential impacts of CVE-2017-7246?
The potential impacts of CVE-2017-7246 include application crashes and possible arbitrary code execution if exploited.