Multiple vulnerabilities have been found in the PCRE Library, the worst of which may allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libpcre | * | < 8.41 | >= 8.41 |
The PCRE Library provides functions for Perl-compatible regular expressions.
Multiple vulnerabilities have been discovered in The PCRE Library. Please review the references below for details.
A remote attacker could possibly cause a Denial of Service condition or other unspecified impacts via a specially crafted file.
There is no known workaround at this time.
All PCRE users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libpcre-8.41"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.
A vulnerability in PCRE library allows remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libpcre | * | < 8.40-r1 | >= 8.40-r1 |
PCRE library is a set of functions that implement regular expression pattern matching using the same syntax and semantics as Perl 5.
It was found that the compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE library is vulnerable to an out-of-bounds read.
A remote attacker could possibly cause a Denial of Service condition via a special crafted regular expression.
There is no known workaround at this time.
All PCRE library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libpcre-8.40-r1"
Multiple vulnerabilities have been found in libpcre, the worst of which could lead to arbitrary code execution, or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libpcre | * | < 8.38-r1 | >= 8.38-r1 |
libpcre is a library providing functions for Perl-compatible regular expressions.
Multiple vulnerabilities have been discovered in libpcre. Please review the CVE identifiers referenced below for details.
An attacker can possibly execute arbitrary code or create a Denial of Service condition.
There is no known workaround at this time.
All libpcre users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libpcre-8.38-r1"
A buffer overflow vulnerability has been discovered in PCRE, allowing for the execution of arbitrary code and a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/glib | * | < 2.16.3-r1 | >= 2.16.3-r1, < 2.14.0 |
| dev-libs/libpcre | * | < 7.7-r1 | >= 7.7-r1 |
PCRE is a Perl-compatible regular expression library. GLib includes a copy of PCRE.
Tavis Ormandy of the Google Security team reported a heap-based buffer overflow when compiling regular expression patterns containing "Internal Option Settings" such as "(?i)".
A remote attacker could exploit this vulnerability by sending a specially crafted regular expression to an application making use of the PCRE library, which could possibly lead to the execution of arbitrary code or a Denial of Service.
There is no known workaround at this time.
All PCRE users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libpcre-7.7-r1"
All GLib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.16.3-r1"
A buffer overflow vulnerability has been discovered in PCRE, allowing for the execution of arbitrary code and Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/glib | * | < 2.14.6 | >= 2.14.6, < 2.14.0 |
| dev-libs/libpcre | * | < 7.6-r1 | >= 7.6-r1 |
PCRE is a Perl-compatible regular expression library. GLib includes a copy of PCRE.
PCRE contains a buffer overflow vulnerability when processing a character class containing a very large number of characters with codepoints greater than 255.
A remote attacker could exploit this vulnerability by sending a specially crafted regular expression to an application making use of the PCRE library, which could possibly lead to the execution of arbitrary code or a Denial of Service.
There is no known workaround at this time.
All PCRE users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libpcre-7.6-r1"
All GLib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.14.6"
PCRE is vulnerable to multiple buffer overflow and memory corruption vulnerabilities, possibly leading to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libpcre | * | < 7.3-r1 | >= 7.3-r1 |
PCRE is a library providing functions for Perl-compatible regular expressions.
Tavis Ormandy (Google Security) discovered multiple vulnerabilities in PCRE. He reported an error when processing "\Q\E" sequences with unmatched "\E" codes that can lead to the compiled bytecode being corrupted (CVE-2007-1659). PCRE does not properly calculate sizes for unspecified "multiple forms of character class", which triggers a buffer overflow (CVE-2007-1660). Further improper calculations of memory boundaries were reported when matching certain input bytes against regex patterns in non UTF-8 mode (CVE-2007-1661) and when searching for unmatched brackets or parentheses (CVE-2007-1662). Multiple integer overflows when processing escape sequences may lead to invalid memory read operations or potentially cause heap-based buffer overflows (CVE-2007-4766). PCRE does not properly handle "\P" and "\P{x}" sequences which can lead to heap-based buffer overflows or trigger the execution of infinite loops (CVE-2007-4767), PCRE is also prone to an error when optimizing character classes containing a singleton UTF-8 sequence which might lead to a heap-based buffer overflow (CVE-2007-4768).
Chris Evans also reported multiple integer overflow vulnerabilities in PCRE when processing a large number of named subpatterns ("name_count") or long subpattern names ("max_name_size") (CVE-2006-7227), and via large "min", "max", or "duplength" values (CVE-2006-7228) both possibly leading to buffer overflows. Another vulnerability was reported when compiling patterns where the "-x" or "-i" UTF-8 options change within the pattern, which might lead to improper memory calculations (CVE-2006-7230).
An attacker could exploit these vulnerabilities by sending specially crafted regular expressions to applications making use of the PCRE library, which could possibly lead to the execution of arbitrary code, a Denial of Service or the disclosure of sensitive information.
There is no known workaround at this time.
All PCRE users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libpcre-7.3-r1"
libpcre is vulnerable to a heap integer overflow, possibly leading to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libpcre | * | < 6.3 | >= 6.3 |
libpcre is a library providing functions for Perl-compatible regular expressions.
libpcre fails to check certain quantifier values in regular expressions for sane values.
An attacker could possibly exploit this vulnerability to execute arbitrary code by sending specially crafted regular expressions to applications making use of the libpcre library.
There is no known workaround at this time.
All libpcre users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libpcre-6.3"