MGASA-2017-0454

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2017-0454.html
Import Source
https://advisories.mageia.org/MGASA-2017-0454.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2017-0454
Upstream
Published
2017-12-21T17:43:29Z
Modified
2026-04-16T01:46:48Z
Summary
Updated pcre packages fix security vulnerabilities
Details

The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression (CVE-2017-6004).

A vulnerability was found in pcre caused by trying to find a Unicode property for a code value greater than 0x10ffff, the Unicode maximum, when running in non-UTF mode (where character values can be up to 0xffffffff) (CVE-2017-7186).

The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file (CVE-2017-7244).

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file (CVE-2017-7245).

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file (CVE-2017-7246).

References
Credits

Affected packages

Mageia:5 / pcre

Package

Name
pcre
Purl
pkg:rpm/mageia/pcre?arch=source&distro=mageia-5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.41-1.mga5

Ecosystem specific 

{
    "section":  "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2017-0454.json"

Mageia:6 / pcre

Package

Name
pcre
Purl
pkg:rpm/mageia/pcre?arch=source&distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.41-1.mga6

Ecosystem specific 

{
    "section":  "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2017-0454.json"