Improper resource allocation - Buffer overflow In pcre3
Description
PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\.|([^\\W_])?)+)+$/.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | 2:8.38-1 | ||
debian 12 | 2:8.38-1 | ||
 nuget | - | ||
 rpm rhel7 | 0:8.32-15.el7_2.1 | ||
rpm rhel7 | - | - | |
rpm rhel6 | - | - | |
rpm rhel7 | - | - | |
rpm rhel6 | - | - |
Aliases
1. 2. 3. 4. 5. 6.