7.5 - DSA-1570

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	New kazehakase packages fix execution of arbitrary code

Informations
Name	DSA-1570	First vendor Publication	2008-05-06
Vendor	Debian	Last vendor Modification	2008-05-06
Severity (Vendor)	N/A	Revision	1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Andrews Salomon reported that kazehakase, a GTK+-base web browser that allows pluggable rendering engines, contained an embedded copy of the PCRE library in its source tree which was compiled in and used in preference to the system-wide version of this library.

The PCRE library has been updated to fix the security issues reported against it in previous Debian Security Advisories. This update ensures that kazehakase uses that supported library, and not its own embedded and insecure version.

For the stable distribution (etch), this problem has been fixed in version 0.4.2-1etch1.

We recommend that you upgrade your kazehakase package.

Original Source

Url : http://www.debian.org/security/2008/dsa-1570

CWE : Common Weakness Enumeration

%	Id	Name
57 %	CWE-189	Numeric Errors (CWE/SANS Top 25)
43 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10408

Oval ID:	oval:org.mitre.oval:def:10408
Title:	Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (name_count) or long subpattern names (max_name_size), which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
Description:	Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (name_count) or long subpattern names (max_name_size), which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2006-7227	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section pcre-devel is earlier than 0:4.5-4.el4_5.4 AND pcre is earlier than 0:4.5-4.el4_5.4 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section pcre-devel is earlier than 0:6.6-2.el5_1.1 AND pcre is earlier than 0:6.6-2.el5_1.1

Definition Id: oval:org.mitre.oval:def:10562

Oval ID:	oval:org.mitre.oval:def:10562
Title:	Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate sizes for unspecified "multiple forms of character class", which triggers a buffer overflow that allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code.
Description:	Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate sizes for unspecified "multiple forms of character class", which triggers a buffer overflow that allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-1660	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section pcre-devel is earlier than 0:3.9-10.4 AND pcre is earlier than 0:3.9-10.4 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section pcre-devel is earlier than 0:4.5-4.el4_5.1 AND pcre is earlier than 0:4.5-4.el4_5.1 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section pcre-devel is earlier than 0:6.6-2.el5_0.1 AND pcre is earlier than 0:6.6-2.el5_0.1

Definition Id: oval:org.mitre.oval:def:10810

Oval ID:	oval:org.mitre.oval:def:10810
Title:	Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 might allow context-dependent attackers to execute arbitrary code via a regular expression that involves large (1) min, (2) max, or (3) duplength values that cause an incorrect length calculation and trigger a buffer overflow, a different vulnerability than CVE-2006-7227. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
Description:	Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 might allow context-dependent attackers to execute arbitrary code via a regular expression that involves large (1) min, (2) max, or (3) duplength values that cause an incorrect length calculation and trigger a buffer overflow, a different vulnerability than CVE-2006-7227. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2006-7228	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section python-devel is earlier than 0:2.2.3-6.8 AND tkinter is earlier than 0:2.2.3-6.8 AND python-tools is earlier than 0:2.2.3-6.8 AND python is earlier than 0:2.2.3-6.8 AND pcre-devel is earlier than 0:3.9-10.4 AND pcre is earlier than 0:3.9-10.4 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section python-devel is earlier than 0:2.3.4-14.4.el4_6.1 AND tkinter is earlier than 0:2.3.4-14.4.el4_6.1 AND python-tools is earlier than 0:2.3.4-14.4.el4_6.1 AND python is earlier than 0:2.3.4-14.4.el4_6.1 AND pcre-devel is earlier than 0:4.5-4.el4_6.6 AND python-docs is earlier than 0:2.3.4-14.4.el4_6.1 AND pcre is earlier than 0:4.5-4.el4_6.6 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section pcre-devel is earlier than 0:6.6-2.el5_1.7 AND pcre is earlier than 0:6.6-2.el5_1.7

Definition Id: oval:org.mitre.oval:def:10911

Oval ID:	oval:org.mitre.oval:def:10911
Title:	Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate the amount of memory needed for a compiled regular expression pattern when the (1) -x or (2) -i UTF-8 options change within the pattern, which allows context-dependent attackers to cause a denial of service (PCRE or glibc crash) via crafted regular expressions.
Description:	Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate the amount of memory needed for a compiled regular expression pattern when the (1) -x or (2) -i UTF-8 options change within the pattern, which allows context-dependent attackers to cause a denial of service (PCRE or glibc crash) via crafted regular expressions.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2006-7230	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section pcre-devel is earlier than 0:4.5-4.el4_6.6 AND pcre is earlier than 0:4.5-4.el4_6.6 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section pcre-devel is earlier than 0:6.6-2.el5_1.7 AND pcre is earlier than 0:6.6-2.el5_1.7

Definition Id: oval:org.mitre.oval:def:17651

Oval ID:	oval:org.mitre.oval:def:17651
Title:	USN-547-1 -- pcre3 vulnerabilities
Description:	Tavis Ormandy and Will Drewry discovered multiple flaws in the regular expression handling of PCRE.
Family:	unix	Class:	patch
Reference(s):	USN-547-1 CVE-2007-1659 CVE-2007-1660 CVE-2007-1661 CVE-2007-1662 CVE-2007-4766 CVE-2007-4767 CVE-2007-4768	Version:	7
Platform(s):	Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10	Product(s):	pcre3
Definition Synopsis:
Release section Ubuntu 6.06 is installed Packages match section libpcre3 DPKG is earlier than 7.4-0ubuntu0.6.06.1 AND libpcrecpp0 DPKG is earlier than 7.4-0ubuntu0.6.06.1 AND Release section Ubuntu 6.10 is installed Packages match section libpcre3 DPKG is earlier than 7.4-0ubuntu0.6.10.1 AND libpcrecpp0 DPKG is earlier than 7.4-0ubuntu0.6.10.1 AND Release section Ubuntu 7.04 is installed Packages match section libpcre3 DPKG is earlier than 7.4-0ubuntu0.7.04.1 AND libpcrecpp0 DPKG is earlier than 7.4-0ubuntu0.7.04.1 AND Release section Ubuntu 7.10 is installed Packages match section libpcre3 DPKG is earlier than 7.4-0ubuntu0.7.10.1 AND libpcrecpp0 DPKG is earlier than 7.4-0ubuntu0.7.10.1

Definition Id: oval:org.mitre.oval:def:18752

Oval ID:	oval:org.mitre.oval:def:18752
Title:	DSA-1570-1 kazehakase - execution of arbitrary code
Description:	Andrews Salomon reported that kazehakase, a GTK+-based web browser that allows pluggable rendering engines, contained an embedded copy of the PCRE library in its source tree which was compiled in and used in preference to the system-wide version of this library.
Family:	unix	Class:	patch
Reference(s):	DSA-1570-1 CVE-2006-7227 CVE-2006-7228 CVE-2006-7230 CVE-2007-1659 CVE-2007-1660 CVE-2007-1661 CVE-2007-1662 CVE-2007-4766 CVE-2007-4767 CVE-2007-4768	Version:	7
Platform(s):	Debian GNU/Linux 4.0	Product(s):	kazehakase
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND kazehakase DPKG is earlier than 0.4.2-1etch1

Definition Id: oval:org.mitre.oval:def:20218

Oval ID:	oval:org.mitre.oval:def:20218
Title:	DSA-1399-1 pcre3 - arbitrary code execution
Description:	Tavis Ormandy of the Google Security Team has discovered several security issues in PCRE, the Perl-Compatible Regular Expression library, which potentially allow attackers to execute arbitrary code by compiling specially crafted regular expressions.
Family:	unix	Class:	patch
Reference(s):	DSA-1399-1 CVE-2007-1659 CVE-2007-1660 CVE-2007-1661 CVE-2007-1662 CVE-2007-4766 CVE-2007-4767 CVE-2007-4768	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	pcre3
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND pcre3 DPKG is earlier than 0:6.7+7.4-2

Definition Id: oval:org.mitre.oval:def:21849

Oval ID:	oval:org.mitre.oval:def:21849
Title:	ELSA-2007:1052: pcre security update (Important)
Description:	Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (name_count) or long subpattern names (max_name_size), which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:1052-02 CVE-2005-4872 CVE-2006-7227	Version:	13
Platform(s):	Oracle Linux 5	Product(s):	pcre
Definition Synopsis:
Oracle Linux 5.x rpm test pcre-devel is earlier than 0:6.6-2.el5_1.1 AND pcre is earlier than 0:6.6-2.el5_1.1

Definition Id: oval:org.mitre.oval:def:22565

Oval ID:	oval:org.mitre.oval:def:22565
Title:	ELSA-2007:1059: pcre security update (Important)
Description:	Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate the amount of memory needed for a compiled regular expression pattern when the (1) -x or (2) -i UTF-8 options change within the pattern, which allows context-dependent attackers to cause a denial of service (PCRE or glibc crash) via crafted regular expressions.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:1059-01 CVE-2006-7225 CVE-2006-7226 CVE-2006-7228 CVE-2006-7230	Version:	21
Platform(s):	Oracle Linux 5	Product(s):	pcre
Definition Synopsis:
Oracle Linux 5.x rpm test pcre-devel is earlier than 0:6.6-2.el5_1.7 AND pcre is earlier than 0:6.6-2.el5_1.7

Definition Id: oval:org.mitre.oval:def:22606

Oval ID:	oval:org.mitre.oval:def:22606
Title:	ELSA-2007:0967: pcre security update (Critical)
Description:	Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate sizes for unspecified "multiple forms of character class", which triggers a buffer overflow that allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:0967-02 CVE-2007-1659 CVE-2007-1660	Version:	13
Platform(s):	Oracle Linux 5	Product(s):	pcre
Definition Synopsis:
Oracle Linux 5.x rpm test pcre-devel is earlier than 0:6.6-2.el5_0.1 AND pcre is earlier than 0:6.6-2.el5_0.1

Definition Id: oval:org.mitre.oval:def:8010

Oval ID:	oval:org.mitre.oval:def:8010
Title:	DSA-1570 kazehakase -- various
Description:	Andrews Salomon reported that kazehakase, a GTK+-based web browser that allows pluggable rendering engines, contained an embedded copy of the PCRE library in its source tree which was compiled in and used in preference to the system-wide version of this library. The PCRE library has been updated to fix the security issues reported against it in previous Debian Security Advisories. This update ensures that kazehakase uses that supported library, and not its own embedded and insecure version.
Family:	unix	Class:	patch
Reference(s):	DSA-1570 CVE-2006-7227 CVE-2006-7228 CVE-2006-7230 CVE-2007-1659 CVE-2007-1660 CVE-2007-1661 CVE-2007-1662 CVE-2007-4766 CVE-2007-4767 CVE-2007-4768	Version:	3
Platform(s):	Debian GNU/Linux 4.0	Product(s):	kazehakase
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is mips AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND kazehakase is earlier than 0.4.2-1etch1

Definition Id: oval:org.mitre.oval:def:9701

Oval ID:	oval:org.mitre.oval:def:9701
Title:	Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.
Description:	Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2007-4768	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2012 Microsoft Windows 8.1 Microsoft Windows Server 2012 R2	Product(s):	Adobe Flash Player Adobe Reader Adobe Acrobat
Definition Synopsis:
Vulnerable version of Adobe Flash Player Adobe Flash Player 9 is installed AND Adobe Flash Player version is less than or equal 9.0.48.0 OR Adobe Reader /8.x Version Adobe Reader 8 Series is installed AND Check if the version of Adobe Reader is less than 8.1.2 OR Adobe Reader / 7.x Version Adobe Reader 7 Series is installed AND Check if the version of Adobe Reader is less than 7.1.0 OR Adobe Acrobat/ 8.x Version Adobe Acrobat 8 Series is installed AND Check if the version of Adobe Acrobat is less than 8.1.2 OR Adobe Acrobat / 7.x Version Adobe Acrobat 7 Series is installed AND Check if the version of Adobe Acrobat is less than 7.1.0 OR Flash.ocx section ActiveX Control is installed AND Determine if the version of Flash.ocx is less than or equal 9.0.48.0

Definition Id: oval:org.mitre.oval:def:9725

Oval ID:	oval:org.mitre.oval:def:9725
Title:	Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via regex patterns containing unmatched "\Q\E" sequences with orphan "\E" codes.
Description:	Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via regex patterns containing unmatched "\Q\E" sequences with orphan "\E" codes.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-1659	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section pcre-devel is earlier than 0:4.5-4.el4_6.6 AND pcre is earlier than 0:4.5-4.el4_6.6 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section pcre-devel is earlier than 0:6.6-2.el5_0.1 AND pcre is earlier than 0:6.6-2.el5_0.1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Pcre cpe:2.3:a:pcre:pcre:6.1:::::::* cpe:2.3:a:pcre:pcre:6.0:::::::* cpe:2.3:a:pcre:pcre:5.0:::::::* cpe:2.3:a:pcre:pcre::::::::	4
Application	Pcre Perl-Compatible Regular Expression Library cpe:2.3:a:pcre:perl-compatible_regular_expression_library:7.1:::::::* cpe:2.3:a:pcre:perl-compatible_regular_expression_library:7.0:::::::*	2
Os	Apple Mac Os X cpe:2.3:o:apple:mac_os_x:10.4.11:::::::*	1
Os	Apple Mac Os X Server cpe:2.3:o:apple:mac_os_x_server:10.4.11:::::::*	1

OpenVAS Exploits

Date	Description
2010-05-12	Name : Mac OS X Security Update 2007-009 File : nvt/macosx_secupd_2007-009.nasl
2009-11-17	Name : Mac OS X Version File : nvt/macosx_version.nasl
2009-10-13	Name : SLES10: Security update for pcre File : nvt/sles10_pcre.nasl
2009-10-10	Name : SLES9: Security update for pcre File : nvt/sles9p5018729.nasl
2009-10-10	Name : SLES9: Security update for Python File : nvt/sles9p5015916.nasl
2009-10-10	Name : SLES9: Security update for pcre File : nvt/sles9p5015818.nasl
2009-10-10	Name : SLES9: Security update for PHP4 File : nvt/sles9p5015662.nasl
2009-10-10	Name : SLES9: Security update for pcre File : nvt/sles9p5013426.nasl
2009-04-09	Name : Mandriva Update for pcre MDKSA-2007:212 (pcre) File : nvt/gb_mandriva_MDKSA_2007_212.nasl
2009-04-09	Name : Mandriva Update for pcre MDKSA-2007:211 (pcre) File : nvt/gb_mandriva_MDKSA_2007_211.nasl
2009-03-23	Name : Ubuntu Update for pcre3 vulnerabilities USN-547-1 File : nvt/gb_ubuntu_USN_547_1.nasl
2009-03-06	Name : RedHat Update for pcre RHSA-2007:1059-01 File : nvt/gb_RHSA-2007_1059-01_pcre.nasl
2009-03-06	Name : RedHat Update for pcre RHSA-2007:1063-01 File : nvt/gb_RHSA-2007_1063-01_pcre.nasl
2009-03-06	Name : RedHat Update for pcre RHSA-2007:1065-01 File : nvt/gb_RHSA-2007_1065-01_pcre.nasl
2009-03-06	Name : RedHat Update for pcre RHSA-2007:1068-01 File : nvt/gb_RHSA-2007_1068-01_pcre.nasl
2009-03-06	Name : RedHat Update for python RHSA-2007:1076-02 File : nvt/gb_RHSA-2007_1076-02_python.nasl
2009-03-06	Name : RedHat Update for python RHSA-2007:1077-01 File : nvt/gb_RHSA-2007_1077-01_python.nasl
2009-03-06	Name : RedHat Update for php RHSA-2008:0546-01 File : nvt/gb_RHSA-2008_0546-01_php.nasl
2009-02-27	Name : CentOS Update for pcre CESA-2007:1063 centos3 i386 File : nvt/gb_CESA-2007_1063_pcre_centos3_i386.nasl
2009-02-27	Name : CentOS Update for python-docs CESA-2007:1076 centos3 x86_64 File : nvt/gb_CESA-2007_1076_python-docs_centos3_x86_64.nasl
2009-02-27	Name : CentOS Update for python-docs CESA-2007:1076 centos3 i386 File : nvt/gb_CESA-2007_1076_python-docs_centos3_i386.nasl
2009-02-27	Name : CentOS Update for pcre CESA-2007:1065-01 centos2 i386 File : nvt/gb_CESA-2007_1065-01_pcre_centos2_i386.nasl
2009-02-27	Name : CentOS Update for pcre CESA-2007:1063 centos3 x86_64 File : nvt/gb_CESA-2007_1063_pcre_centos3_x86_64.nasl
2009-02-27	Name : CentOS Update for php CESA-2008:0546-01 centos2 i386 File : nvt/gb_CESA-2008_0546-01_php_centos2_i386.nasl
2009-02-27	Name : CentOS Update for python CESA-2007:1077-01 centos2 i386 File : nvt/gb_CESA-2007_1077-01_python_centos2_i386.nasl
2009-02-16	Name : Fedora Update for pcre FEDORA-2008-1842 File : nvt/gb_fedora_2008_1842_pcre_fc7.nasl
2009-01-28	Name : SuSE Update for flash-player SUSE-SA:2007:069 File : nvt/gb_suse_2007_069.nasl
2009-01-28	Name : SuSE Update for pcre SUSE-SA:2007:062 File : nvt/gb_suse_2007_062.nasl
2009-01-23	Name : SuSE Update for php4, php5 SUSE-SA:2008:004 File : nvt/gb_suse_2008_004.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200711-30 (libpcre) File : nvt/glsa_200711_30.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200805-11 (chicken) File : nvt/glsa_200805_11.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200802-10 (python) File : nvt/glsa_200802_10.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200801-19 (goffice) File : nvt/glsa_200801_19.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200801-18 (kazehakase) File : nvt/glsa_200801_18.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200801-07 (netscape-flash) File : nvt/glsa_200801_07.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200801-02 (R) File : nvt/glsa_200801_02.nasl
2008-09-04	Name : FreeBSD Ports: pcre, pcre-utf8 File : nvt/freebsd_pcre0.nasl
2008-09-04	Name : FreeBSD Ports: linux-flashplugin File : nvt/freebsd_linux-flashplugin2.nasl
2008-05-12	Name : Debian Security Advisory DSA 1570-1 (kazehakase) File : nvt/deb_1570_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 1399-1 (pcre3) File : nvt/deb_1399_1.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
40766	Perl-Compatible Regular Expression (PCRE) Singleton Unicode Sequence Handling...
40765	Perl-Compatible Regular Expression (PCRE) Unmatched Brackets / Parentheses Se...
40764	Perl-Compatible Regular Expression (PCRE) Character Class Calculation overflow
40763	Perl-Compatible Regular Expression (PCRE) Unmatched "\Q\E" Sequence...
40761	Perl-Compatible Regular Expression (PCRE) Non-UTF-8 Mode Pattern Matching Inf...
40760	Perl-Compatible Regular Expression (PCRE) \P Sequence DoS
40759	Perl-Compatible Regular Expression (PCRE) Unspecified Escape (backslash) Sequ...
40758	Perl-Compatible Regular Expression (PCRE) Compiled UTF-8 Options Pattern DoS
40756	Perl-Compatible Regular Expression (PCRE) Regexp Subpattern Handling Overflow
40754	Perl-Compatible Regular Expression (PCRE) Crafted Regexp Parsing Overflow

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0967.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0968.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1076.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1068.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1063.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1059.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1052.nasl - Type : ACT_GATHER_INFO
2013-06-29	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1068.nasl - Type : ACT_GATHER_INFO
2013-03-06	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071129_pcre_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071105_pcre_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071210_python_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071109_pcre_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2010-01-06	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0967.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12049.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12013.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12000.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_11998.nasl - Type : ACT_GATHER_INFO
2009-08-28	Name : The version of Adobe Acrobat on the remote Windows host is affected by multip... File : adobe_acrobat_812.nasl - Type : ACT_GATHER_INFO
2009-08-24	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-1126.nasl - Type : ACT_GATHER_INFO
2009-07-27	Name : The remote VMware ESX host is missing one or more security-related patches. File : vmware_VMSA-2008-0003.nasl - Type : ACT_GATHER_INFO
2009-07-27	Name : The remote VMware ESX host is missing one or more security-related patches. File : vmware_VMSA-2008-0007.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-211.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1063.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1052.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0968.nasl - Type : ACT_GATHER_INFO
2008-07-16	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0546.nasl - Type : ACT_GATHER_INFO
2008-05-09	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1570.nasl - Type : ACT_GATHER_INFO
2008-03-19	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-002.nasl - Type : ACT_GATHER_INFO
2008-03-07	Name : The remote Fedora host is missing a security update. File : fedora_2008-1842.nasl - Type : ACT_GATHER_INFO
2008-02-25	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200802-10.nasl - Type : ACT_GATHER_INFO
2008-02-06	Name : The PDF file viewer on the remote Windows host is affected by multiple vulner... File : adobe_reader_812.nasl - Type : ACT_GATHER_INFO
2008-01-21	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200801-07.nasl - Type : ACT_GATHER_INFO
2008-01-08	Name : The remote openSUSE host is missing a security update. File : suse_pcre-4750.nasl - Type : ACT_GATHER_INFO
2008-01-08	Name : The remote openSUSE host is missing a security update. File : suse_pcre-4708.nasl - Type : ACT_GATHER_INFO
2008-01-08	Name : The remote openSUSE host is missing a security update. File : suse_apache2-mod_php5-4810.nasl - Type : ACT_GATHER_INFO
2008-01-04	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_562cf6c4b9f111dca302000102cc8983.nasl - Type : ACT_GATHER_INFO
2007-12-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_flash-player-4856.nasl - Type : ACT_GATHER_INFO
2007-12-24	Name : The remote openSUSE host is missing a security update. File : suse_flash-player-4855.nasl - Type : ACT_GATHER_INFO
2007-12-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-mod_php5-4808.nasl - Type : ACT_GATHER_INFO
2007-12-19	Name : The remote Windows host contains a browser plugin that is affected by multipl... File : flash_player_apsb07-20.nasl - Type : ACT_GATHER_INFO
2007-12-18	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2007-009.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_pcre-4748.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_pcre-4707.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_pcre-4689.nasl - Type : ACT_GATHER_INFO
2007-12-11	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1076.nasl - Type : ACT_GATHER_INFO
2007-12-11	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1076.nasl - Type : ACT_GATHER_INFO
2007-12-11	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1077.nasl - Type : ACT_GATHER_INFO
2007-12-07	Name : The remote openSUSE host is missing a security update. File : suse_glib2-4768.nasl - Type : ACT_GATHER_INFO
2007-11-30	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1059.nasl - Type : ACT_GATHER_INFO
2007-11-30	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1063.nasl - Type : ACT_GATHER_INFO
2007-11-30	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1065.nasl - Type : ACT_GATHER_INFO
2007-11-30	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1068.nasl - Type : ACT_GATHER_INFO
2007-11-29	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-547-1.nasl - Type : ACT_GATHER_INFO
2007-11-26	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200711-30.nasl - Type : ACT_GATHER_INFO
2007-11-20	Name : The remote openSUSE host is missing a security update. File : suse_pcre-4696.nasl - Type : ACT_GATHER_INFO
2007-11-20	Name : The remote openSUSE host is missing a security update. File : suse_pcre-4697.nasl - Type : ACT_GATHER_INFO
2007-11-20	Name : The remote openSUSE host is missing a security update. File : suse_pcre-4683.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1052.nasl - Type : ACT_GATHER_INFO
2007-11-09	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-212.nasl - Type : ACT_GATHER_INFO
2007-11-07	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_bfd6eef48c9411dc8c55001c2514716c.nasl - Type : ACT_GATHER_INFO
2007-11-06	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0968.nasl - Type : ACT_GATHER_INFO
2007-11-06	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0967.nasl - Type : ACT_GATHER_INFO
2007-11-06	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1399.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:27:37	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	7
Oval ID(s)	13
CPE ID(s)	8
osvdb(s)	10
Openvas Exploit(s)	40
Nessus® Exploit(s)	63

	Related
7.5	CVE-2007-4766
6.8	CVE-2007-4768
6.8	CVE-2007-1660
6.8	CVE-2007-1659
6.8	CVE-2006-7228
6.8	CVE-2006-7227
6.4	CVE-2007-1661
5	CVE-2007-4767
5	CVE-2007-1662
4.3	CVE-2006-7230
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 10 more Alert(s)