Fluid Attacks Database

Description

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	pcre3	=2:8.39-13 \|\| =2:8.39-14 \|\| =2:8.39-15 \|\| =2:8.39-15.1	-
debian 12	pcre3	=2:8.39-15 \|\| =2:8.39-15.1	-
rpm rhel8	pcre	<0:8.42-6.el8	0:8.42-6.el8

Aliases

1. CVE-2019-208382. NVD-2019-208383. OSV-DEBIAN-2019-208384. OSV-2019-208385. SECURITY-TRACKER-CVE-2019-20838

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.