REDHAT-BUG-315881: Pcre vulnerability
Tavis Ormandy of the Google Security Team reported multiple pcre regular expressions flaws. Here are the details pasted from Tavis' mail:
CVE-2007-1660: multiple forms of character class had their sizes miscalculated on initial passes, resulting in too little memory being allocated, this was also inadvertently fixed in version 7.0, where the compile phase was entirely re-engineered (and much improved, from a security standpoint).
Acknowledgements:
Red Hat would like to thank Tavis Ormandy and Will Drewry for properly disclosing these issues.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-315881?
The severity of REDHAT-BUG-315881 is considered high due to memory allocation flaws that can lead to potential security vulnerabilities.
How do I fix REDHAT-BUG-315881?
To fix REDHAT-BUG-315881, update PCRE to version 7.0 or later, which addresses the memory allocation issues.
What are the potential risks of REDHAT-BUG-315881?
The potential risks of REDHAT-BUG-315881 include denial of service attacks and the possibility of arbitrary code execution due to improper memory allocation.
Is my software affected by REDHAT-BUG-315881?
If you are using PCRE versions earlier than 7.0, your software is affected by REDHAT-BUG-315881.
Who reported the vulnerability identified as REDHAT-BUG-315881?
The vulnerability identified as REDHAT-BUG-315881 was reported by Tavis Ormandy of the Google Security Team.