CVE-2006-7226 — Glib2.0 vulnerability

6 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
1.7%
top 17.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Debian Glib2.0Debian Pcre3Redhat Enterprise Linux+1 more
Timeline
PublishedDec 3
Latest updateMay 1

Description

Perl-Compatible Regular Expression (PCRE) library before 6.7 does not properly calculate the compiled memory allocation for regular expressions that involve a quantified "subpattern containing a named recursion or subroutine reference," which allows context-dependent attackers to cause a denial of service (error or crash).

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/pcre3< glib2.0 2.14.3-1 (bookworm)
▶debiandebian/glib2.0< glib2.0 2.14.3-1 (bookworm)

Also affects: Enterprise Linux 4.0

🔴Vulnerability Details

2
GHSA
GHSA-pjwm-g353-8cr7: Perl-Compatible Regular Expression (PCRE) library before 6↗2022-05-01
▶
OSV
CVE-2006-7226: Perl-Compatible Regular Expression (PCRE) library before 6↗2007-12-03
▶

📋Vendor Advisories

2
Red Hat
pcre miscalculation of memory requirements for repeated subpattern containing a named recursion or subroutine reference↗2007-11-13
▶
Debian
CVE-2006-7226: glib2.0 - Perl-Compatible Regular Expression (PCRE) library before 6.7 does not properly c...↗2006
▶

💬Community

1
Bugzilla
CVE-2006-7226 pcre miscalculation of memory requirements for repeated subpattern containing a named recursion or subroutine reference↗2007-11-15
▶