CVE-2008-2371 — Out-of-bounds Write in Pcre

CWE-787 — Out-of-bounds WriteCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer9 documents7 sources
Severity
7.5HIGHNVD
EPSS
4.1%
top 11.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Debian Pcre3PHPCanonical Ubuntu Linux+4 more
Timeline
PublishedJul 7
Latest updateMay 1

Description

Heap-based buffer overflow in pcre_compile.c in the Perl-Compatible Regular Expression (PCRE) library 7.7 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a regular expression that begins with an option and contains multiple branches.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages4 packages

▶debiandebian/pcre3< pcre3 7.6-2.1 (bookworm)
▶NVDpcre/pcre7.7
▶NVDphp/php5.2.0 — 5.2.7

Also affects: Debian Linux 4.0, Fedora 8, 9, Ubuntu Linux 6.06, 7.04, 7.10, 8.04, 9.10

🔴Vulnerability Details

2
GHSA
GHSA-853v-4rcq-pjpw: Heap-based buffer overflow in pcre_compile↗2022-05-01
▶
OSV
CVE-2008-2371: Heap-based buffer overflow in pcre_compile↗2008-07-07
▶

📋Vendor Advisories

5
Ubuntu
Erlang vulnerability↗2010-04-09
▶
Ubuntu
PHP vulnerabilities↗2008-07-23
▶
Ubuntu
PCRE vulnerability↗2008-07-15
▶
Red Hat
pcre: heap overflow caused by incorrect option handling↗2008-06-26
▶
Debian
CVE-2008-2371: pcre3 - Heap-based buffer overflow in pcre_compile.c in the Perl-Compatible Regular Expr...↗2008
▶

💬Community

1
Bugzilla
CVE-2008-2371 pcre: heap overflow caused by incorrect option handling↗2008-06-19
▶
CVE-2008-2371 — Out-of-bounds Write in Pcre | cvebase