The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3652-1 advisory.

  - The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680     (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds     read and application crash) via a crafted regular expression. (CVE-2017-6004)

  - libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service     (segmentation violation for read access, and application crash) by triggering an invalid Unicode property     lookup. (CVE-2017-7186)

  - The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a     denial of service (invalid memory read) via a crafted file. (CVE-2017-7244)

  - Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40     allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other     impact via a crafted file. (CVE-2017-7245)

  - Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40     allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified     other impact via a crafted file. (CVE-2017-7246)

  - libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R     has more than one fixed quantifier, a related issue to CVE-2019-20454. (CVE-2019-20838)

  - libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
    (CVE-2020-14155)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLED12 / SLES12 Security Update : pcre (SUSE-SU-2021:3652-1)

high Nessus Plugin ID 155134

Version 1.4

Version 1.3

Version 1.4 Jul 14, 2023, 5:13 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Detection Plugin metadata Plugin Feed: 202307140513
Version 1.3 Jul 12, 2023, 5:37 PM Detection Plugin Feed: 202307121737