An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5251 advisory.

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the     compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property     matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully     read in case-less matching within JIT. (CVE-2022-1586)

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length()     function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular     expressions caused by duplicate data transfers. (CVE-2022-1587)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5627-2 advisory.

    USN-5627-1 fixed several vulnerabilities in PCRE. This update provides the corresponding fixes for Ubuntu     18.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Business Intelligence Enterprise Edition (OBIEE) (OAS) installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory.

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Commons BeanUtils)). The supported version that is affected is     6.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence     Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business     Intelligence Enterprise Edition accessible data and unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2019-10086)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (zlib)). The supported version that is affected is 6.4.0.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in     takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2022-37434)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: BI Application Archive (Apache Commons Text)). The supported version that is affected is     6.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2022-42889)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-045 advisory.

    An out-of-bounds read vulnerability was discovered in the PCRE2 library in the     compile_xclass_matchingpath() function of the  pcre2_jit_compile.c file. This involves a unicode property     matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully     read in case-less matching within JIT. (CVE-2022-1586)

    An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length()     function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular     expressions caused by duplicate data transfers. (CVE-2022-1587)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3363 advisory.

  - An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to     match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may     be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in     do_extuni_no_utf in pcre2_jit_compile.c. (CVE-2019-20454)

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the     compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property     matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully     read in case-less matching within JIT. (CVE-2022-1586)

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length()     function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular     expressions caused by duplicate data transfers. (CVE-2022-1587)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the pcre2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the     compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property     matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully     read in case-less matching within JIT. (CVE-2022-1586)

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length()     function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular     expressions caused by duplicate data transfers. (CVE-2022-1587)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:5251 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-191 advisory.

    An out-of-bounds read vulnerability was discovered in the PCRE2 library in the     compile_xclass_matchingpath() function of the  pcre2_jit_compile.c file. This involves a unicode property     matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully     read in case-less matching within JIT. (CVE-2022-1586)

    An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length()     function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular     expressions caused by duplicate data transfers. (CVE-2022-1587)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 19c and 21c versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Oracle Database - Machine Learning (Numpy) component of Oracle Database Server. The     supported version that is affected is 21c. Easily exploitable vulnerability allows low privileged attacker     having Create Session privilege with network access via Oracle Net to compromise Oracle Database - Machine     Learning (Numpy). (CVE-2021-41495)  

  - Vulnerability in the Spatial and Graph (jackson-databind) component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged attacker     having Authenticated User privilege with network access via HTTP to compromise Spatial and     Graph (jackson-databind). Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Spatial and Graph (jackson-databind).
    (CVE-2020-36518)

  - Vulnerability in the Oracle Notification Server (PCRE2) component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged     attacker having Subscriber privilege with network access via HTTP to compromise Oracle Notification     Server (PCRE2). Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle Notification Server (PCRE2).
    Note: This vulnerability applies to Windows systems only. (CVE-2022-1587)

  - Vulnerability in the Oracle Database - Advanced Queuing component of Oracle Database Server. The supported     version that is affected is 19c. Easily exploitable vulnerability allows high privileged attacker having     DBA user privilege with network access via Oracle Net to compromise Oracle Database - Advanced Queuing.
    Successful attacks of this vulnerability can result in takeover of Oracle Database - Advanced Queuing.
    (CVE-2022-21596)

  - Vulnerability in the Oracle Database - Sharding component of Oracle Database Server. Supported versions     that are affected are 19c and 21c. Easily exploitable vulnerability allows high privileged attacker having     Local Logon privilege with network access via Local Logon to compromise Oracle Database - Sharding.
    Successful attacks of this vulnerability can result in takeover of Oracle Database - Sharding.
    (CVE-2022-21603)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the pcre2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the     compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property     matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully     read in case-less matching within JIT. (CVE-2022-1586)

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length()     function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular     expressions caused by duplicate data transfers. (CVE-2022-1587)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5627-1 advisory.

    It was discovered that PCRE incorrectly handled memory when

    handling certain regular expressions. An attacker could possibly use this issue to cause applications     using PCRE to expose sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the pcre2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the     compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property     matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully     read in case-less matching within JIT. (CVE-2022-1586)

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length()     function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular     expressions caused by duplicate data transfers. (CVE-2022-1587)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-071 advisory.

    An out-of-bounds read vulnerability was discovered in the PCRE2 library in the     compile_xclass_matchingpath() function of the  pcre2_jit_compile.c file. This involves a unicode property     matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully     read in case-less matching within JIT. (CVE-2022-1586)

    An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length()     function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular     expressions caused by duplicate data transfers. (CVE-2022-1587)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2649-1 advisory.

  - An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to     match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may     be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in     do_extuni_no_utf in pcre2_jit_compile.c. (CVE-2019-20454)

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length()     function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular     expressions caused by duplicate data transfers. (CVE-2022-1587)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2566-1 advisory.

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length()     function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular     expressions caused by duplicate data transfers. (CVE-2022-1587)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2565-1 advisory.

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length()     function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular     expressions caused by duplicate data transfers. (CVE-2022-1587)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-5251 advisory.

    [10.37-5]
    - Explicitly require uft subpackages in tools subpackage

    [10.37-4]
    - Resolves: CVE-2022-1586 CVE-2022-1587

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5251 advisory.

    The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for     implementing regular expression pattern matching using the same syntax and semantics as Perl.

    Security Fix(es):

    * pcre2: Out-of-bounds read in compile_xclass_matchingpath in pcre2_jit_compile.c (CVE-2022-1586)

    * pcre2: Out-of-bounds read in get_recurse_data_length in pcre2_jit_compile.c (CVE-2022-1587)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the pcre2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the     compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property     matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully     read in case-less matching within JIT. (CVE-2022-1586)

  - An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length()     function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular     expressions caused by duplicate data transfers. (CVE-2022-1587)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-e56085ba31 advisory.

    Rebase to version 10.40

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
184917	Rocky Linux 9 : pcre2 (RLSA-2022:5251)	Nessus	Rocky Linux Local Security Checks	critical
183121	Ubuntu 18.04 ESM : PCRE vulnerabilities (USN-5627-2)	Nessus	Ubuntu Local Security Checks	critical
174743	Oracle Business Intelligence Enterprise Edition (OAS) (Apr 2023 CPU)	Nessus	Misc.	critical
173161	Amazon Linux 2023 : pcre2, pcre2-devel, pcre2-static (ALAS2023-2023-045)	Nessus	Amazon Linux Local Security Checks	critical
172599	Debian DLA-3363-1 : pcre2 - LTS security update	Nessus	Debian Local Security Checks	critical
169325	EulerOS Virtualization 2.10.0 : pcre2 (EulerOS-SA-2022-2868)	Nessus	Huawei Local Security Checks	critical
169308	EulerOS Virtualization 2.10.1 : pcre2 (EulerOS-SA-2022-2886)	Nessus	Huawei Local Security Checks	critical
167708	AlmaLinux 9 : pcre2 (ALSA-2022:5251)	Nessus	Alma Linux Local Security Checks	critical
167018	Amazon Linux 2022 : pcre2, pcre2-devel, pcre2-static (ALAS2022-2022-191)	Nessus	Amazon Linux Local Security Checks	critical
166370	Oracle Database Server (Oct 2022 CPU)	Nessus	Databases	critical
165963	EulerOS Virtualization 3.0.6.0 : pcre2 (EulerOS-SA-2022-2580)	Nessus	Huawei Local Security Checks	critical
165396	EulerOS Virtualization 2.9.0 : pcre2 (EulerOS-SA-2022-2397)	Nessus	Huawei Local Security Checks	critical
165358	EulerOS Virtualization 2.9.1 : pcre2 (EulerOS-SA-2022-2361)	Nessus	Huawei Local Security Checks	critical
165325	Ubuntu 20.04 LTS / 22.04 LTS : PCRE vulnerabilities (USN-5627-1)	Nessus	Ubuntu Local Security Checks	critical
165070	EulerOS 2.0 SP9 : pcre2 (EulerOS-SA-2022-2330)	Nessus	Huawei Local Security Checks	critical
165033	EulerOS 2.0 SP9 : pcre2 (EulerOS-SA-2022-2301)	Nessus	Huawei Local Security Checks	critical
164738	Amazon Linux 2022 : pcre2, pcre2-devel, pcre2-static (ALAS2022-2022-071)	Nessus	Amazon Linux Local Security Checks	critical
164230	EulerOS 2.0 SP10 : pcre2 (EulerOS-SA-2022-2260)	Nessus	Huawei Local Security Checks	critical
164187	EulerOS 2.0 SP10 : pcre2 (EulerOS-SA-2022-2247)	Nessus	Huawei Local Security Checks	critical
163800	SUSE SLED15 / SLES15 Security Update : pcre2 (SUSE-SU-2022:2649-1)	Nessus	SuSE Local Security Checks	critical
163512	SUSE SLED15 / SLES15 Security Update : pcre2 (SUSE-SU-2022:2566-1)	Nessus	SuSE Local Security Checks	critical
163508	SUSE SLES12 Security Update : pcre2 (SUSE-SU-2022:2565-1)	Nessus	SuSE Local Security Checks	critical
162795	Oracle Linux 9 : pcre2 (ELSA-2022-5251)	Nessus	Oracle Linux Local Security Checks	critical
162663	RHEL 9 : pcre2 (RHSA-2022:5251)	Nessus	Red Hat Local Security Checks	critical
162458	EulerOS 2.0 SP8 : pcre2 (EulerOS-SA-2022-1945)	Nessus	Huawei Local Security Checks	critical
161148	Fedora 36 : pcre2 (2022-e56085ba31)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2022-1587

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical