Perl-Compatible Regular Expression (PCRE) library before 6.2 does not properly count the number of named capturing subpatterns, which allows context-dependent attackers to cause a denial of service (crash) via a regular expression with a large number of named subpatterns, which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.

From Red Hat Security Advisory 2007:1052 :

Updated pcre packages that correct security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

[Updated 15 November 2007] Further analysis of these flaws in PCRE has led to the single CVE identifier CVE-2006-7224 being split into three separate identifiers and a re-analysis of the risk of each of the flaws. We are therefore updating the text of this advisory to use the correct CVE names for the two flaws fixed by these erratum packages, and downgrading the security impact of this advisory from critical to important. No changes have been made to the packages themselves.

PCRE is a Perl-compatible regular expression library.

Flaws were found in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parses a malicious regular expression, it may be possible to run arbitrary code as the user running the application. (CVE-2005-4872, CVE-2006-7227)

Users of PCRE are advised to upgrade to these updated packages, which contain a backported patch to correct these issues.

This importance of this has been reduced to 'Important' We have renumbered the release for SL5 so that it doesn't conflict with the previous pcre security update.

This update fixes multiple bugs in php :

  - several problems in pcre (CVE-2007-1660, CVE-2006-7225,     CVE-2006-7224, CVE-2006-7226 CVE-2007-1659,     CVE-2006-7230)

  - Flaws in processing multi byte sequences in     htmlentities/htmlspecialchars. (CVE-2007-5898)

  - overly long arguments to the dl() function could crash     php. (CVE-2007-4825)

  - overy long arguments to the glob() function could crash     php. (CVE-2007-4782)

  - overly long arguments to some iconv functions could     crash php. (CVE-2007-4840)

  - overy long arguments to the setlocale() function could     crash php. (CVE-2007-4784)

  - the wordwrap-Function could cause a floating point     exception. (CVE-2007-3998)

  - overy long arguments to the fnmatch() function could     crash php. (CVE-2007-4782)

  - incorrect size calculation in the chunk_split function     could lead to a buffer overflow. (CVE-2007-4661,     CVE-2007-2872)

  - Flaws in the GD extension could lead to integer     overflows. (CVE-2007-3996)

  - The money_format function contained format string flaws.
    (CVE-2007-4658)

Apache2 contains a copy of the pcre library. Specially crafted regular expressions could lead to a buffer overflow in the pcre library.
Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code. (CVE-2006-7224, CVE-2007-1660)

Updated pcre packages that correct security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

[Updated 15 November 2007] Further analysis of these flaws in PCRE has led to the single CVE identifier CVE-2006-7224 being split into three separate identifiers and a re-analysis of the risk of each of the flaws. We are therefore updating the text of this advisory to use the correct CVE names for the two flaws fixed by these erratum packages, and downgrading the security impact of this advisory from critical to important. No changes have been made to the packages themselves.

PCRE is a Perl-compatible regular expression library.

Flaws were found in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parses a malicious regular expression, it may be possible to run arbitrary code as the user running the application. (CVE-2005-4872, CVE-2006-7227)

Users of PCRE are advised to upgrade to these updated packages, which contain a backported patch to correct these issues.

This update fixes multiple bugs in php :

  - use system pcre library to fix several pcre     vulnerabilities (CVE-2007-1659, CVE-2006-7230,     CVE-2007-1660, CVE-2006-7227 CVE-2005-4872,     CVE-2006-7228)

  - Flaws in processing multi byte sequences in     htmlentities/htmlspecialchars (CVE-2007-5898)

  - overly long arguments to the dl() function could crash     php (CVE-2007-4825)

  - overy long arguments to the glob() function could crash     php (CVE-2007-4782)

  - overly long arguments to some iconv functions could     crash php (CVE-2007-4840)

  - overy long arguments to the setlocale() function could     crash php (CVE-2007-4784)

  - the wordwrap-Function could cause a floating point     exception (CVE-2007-3998)

  - overy long arguments to the fnmatch() function could     crash php (CVE-2007-4782)

  - incorrect size calculation in the chunk_split function     could lead to a buffer overflow (CVE-2007-4661)

  - Flaws in the GD extension could lead to integer     overflows (CVE-2007-3996)

  - The money_format function contained format string flaws     (CVE-2007-4658)

  - Data for some time zones has been updated

This update fixes multiple bugs in php :

  - use system pcre library to fix several pcre     vulnerabilities. (CVE-2007-1659 / CVE-2006-7230 /     CVE-2007-1660 / CVE-2006-7227 / CVE-2005-4872 /     CVE-2006-7228)

  - Flaws in processing multi byte sequences in     htmlentities/htmlspecialchars. (CVE-2007-5898)

  - overly long arguments to the dl() function could crash     php. (CVE-2007-4825)

  - overy long arguments to the glob() function could crash     php. (CVE-2007-4782)

  - overly long arguments to some iconv functions could     crash php. (CVE-2007-4840)

  - overy long arguments to the setlocale() function could     crash php. (CVE-2007-4784)

  - the wordwrap-Function could cause a floating point     exception. (CVE-2007-3998)

  - overy long arguments to the fnmatch() function could     crash php. (CVE-2007-4782)

  - incorrect size calculation in the chunk_split function     could lead to a buffer overflow. (CVE-2007-4661)

  - Flaws in the GD extension could lead to integer     overflows. (CVE-2007-3996)

  - The money_format function contained format string flaws.
    (CVE-2007-4658)

  - Data for some time zones has been updated

ID	Name	Product	Family	Severity
67610	Oracle Linux 4 : pcre (ELSA-2007-1052)	Nessus	Oracle Linux Local Security Checks	medium
60298	Scientific Linux Security Update : pcre on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41187	SuSE9 Security Update : PHP4 (YOU Patch Number 12049)	Nessus	SuSE Local Security Checks	high
41170	SuSE9 Security Update : Apache 2 (YOU Patch Number 12000)	Nessus	SuSE Local Security Checks	medium
37163	CentOS 4 : pcre (CESA-2007:1052)	Nessus	CentOS Local Security Checks	medium
29878	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-4810)	Nessus	SuSE Local Security Checks	high
29780	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 4808)	Nessus	SuSE Local Security Checks	high
28169	RHEL 4 / 5 : pcre (RHSA-2007:1052)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2005-4872

high

Tenable Plugins

medium

medium

high

medium

medium

high

high

medium