CVE-2019-20454
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2019-20454
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-20454.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2019-20454
- Related
- Published
- 2020-02-14T14:15:10Z
- Modified
- 2024-10-11T10:38:39Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in doextuninoutf in pcre2jit_compile.c.
- References
-
- https://security.gentoo.org/glsa/202006-16
- https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQRAHYHLRNMBTPR3KXVM27NSZP3KTOPI/
- https://bugs.php.net/bug.php?id=78338
- https://bugzilla.redhat.com/show_bug.cgi?id=1735494
- https://vcs.pcre.org/pcre2?view=revision&revision=1092
- https://bugs.exim.org/show_bug.cgi?id=2421
- https://security-tracker.debian.org/tracker/CVE-2019-20454
Affected packages
Debian:11 / pcre2
Package
- Name
- pcre2
- Purl
- pkg:deb/debian/pcre2?arch=source
Debian:12 / pcre2
Package
- Name
- pcre2
- Purl
- pkg:deb/debian/pcre2?arch=source
Debian:13 / pcre2
Package
- Name
- pcre2
- Purl
- pkg:deb/debian/pcre2?arch=source