Vulnerabilidad en PCRE antes de 7.6, desbordamiento de búfer (CVE-2008-0674)
Gravedad CVSS v2.0:
ALTA
Tipo:
CWE-119
Restricción de operaciones inapropiada dentro de los límites del búfer de la memoria
Fecha de publicación:
18/02/2008
Última modificación:
15/10/2018
Descripción
Desbordamiento de búfer en PCRE antes de 7.6 permite a atacantes remotos ejecutar código de su elección a través de una expresión regular que contiene un carácter class con un número grande de caracteres con puntos de código Unicode mayores de 255.
Impacto
Puntuación base 2.0
7.50
Gravedad 2.0
ALTA
Productos y versiones vulnerables
CPE | Desde | Hasta |
---|---|---|
cpe:2.3:a:pcre:pcre:*:*:*:*:*:*:*:* | 7.5 (incluyendo) |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página
Referencias a soluciones, herramientas e información
- http://ftp.gnome.org/pub/gnome/sources/glib/2.14/glib-2.14.6.news
- http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html
- http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
- http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.html
- http://pcre.org/changelog.txt
- http://secunia.com/advisories/28923
- http://secunia.com/advisories/28957
- http://secunia.com/advisories/28960
- http://secunia.com/advisories/28985
- http://secunia.com/advisories/28996
- http://secunia.com/advisories/29027
- http://secunia.com/advisories/29048
- http://secunia.com/advisories/29175
- http://secunia.com/advisories/29267
- http://secunia.com/advisories/29282
- http://secunia.com/advisories/30048
- http://secunia.com/advisories/30345
- http://secunia.com/advisories/31326
- http://secunia.com/advisories/32222
- http://secunia.com/advisories/32746
- http://secunia.com/advisories/36096
- http://security.gentoo.org/glsa/glsa-200803-24.xml
- http://security.gentoo.org/glsa/glsa-200811-05.xml
- http://support.apple.com/kb/HT3216
- http://support.apple.com/kb/HT3757
- http://wiki.rpath.com/Advisories:rPSA-2008-0086
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0086
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0176
- http://www.debian.org/security/2008/dsa-1499
- http://www.mandriva.com/security/advisories?name=MDVSA-2008%3A053
- http://www.openwall.com/lists/oss-security/2008/05/02/2
- http://www.php.net/ChangeLog-5.php
- http://www.securityfocus.com/archive/1/488927/100/0/threaded
- http://www.securityfocus.com/archive/1/492535/100/0/threaded
- http://www.securityfocus.com/bid/27786
- http://www.securityfocus.com/bid/29009
- http://www.securityfocus.com/bid/31681
- http://www.securitytracker.com/id?1022674=
- http://www.us-cert.gov/cas/techalerts/TA09-218A.html
- http://www.vupen.com/english/advisories/2008/0570
- http://www.vupen.com/english/advisories/2008/0592
- http://www.vupen.com/english/advisories/2008/1412
- http://www.vupen.com/english/advisories/2008/2268
- http://www.vupen.com/english/advisories/2008/2780
- http://www.vupen.com/english/advisories/2009/2172
- https://bugzilla.redhat.com/show_bug.cgi?id=431660
- https://exchange.xforce.ibmcloud.com/vulnerabilities/40505
- https://issues.rpath.com/browse/RPL-2223
- https://issues.rpath.com/browse/RPL-2503
- https://usn.ubuntu.com/581-1/
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00371.html
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00632.html
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00181.html