Executive Summary
Summary | |
---|---|
Title | Updated pcre packages fix vulnerability |
Informations | |||
---|---|---|---|
Name | MDKSA-2007:212 | First vendor Publication | 2007-11-08 |
Vendor | Mandriva | Last vendor Modification | 2007-11-08 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 6.8 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Multiple vulnerabilities were discovered by Tavis Ormandy and Will Drewry in the way that pcre handled certain malformed regular expressions. If an application linked against pcre, such as Konqueror, parses a malicious regular expression, it could lead to the execution of arbitrary code as the user running the application. Updated packages have been patched to prevent this issue. |
Original Source
Url : http://www.mandriva.com/security/advisories?name=MDKSA-2007:212 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:10562 | |||
Oval ID: | oval:org.mitre.oval:def:10562 | ||
Title: | Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate sizes for unspecified "multiple forms of character class", which triggers a buffer overflow that allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code. | ||
Description: | Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate sizes for unspecified "multiple forms of character class", which triggers a buffer overflow that allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2007-1660 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:22606 | |||
Oval ID: | oval:org.mitre.oval:def:22606 | ||
Title: | ELSA-2007:0967: pcre security update (Critical) | ||
Description: | Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate sizes for unspecified "multiple forms of character class", which triggers a buffer overflow that allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2007:0967-02 CVE-2007-1659 CVE-2007-1660 | Version: | 13 |
Platform(s): | Oracle Linux 5 | Product(s): | pcre |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:9725 | |||
Oval ID: | oval:org.mitre.oval:def:9725 | ||
Title: | Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via regex patterns containing unmatched "\Q\E" sequences with orphan "\E" codes. | ||
Description: | Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via regex patterns containing unmatched "\Q\E" sequences with orphan "\E" codes. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2007-1659 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 4 |
OpenVAS Exploits
Date | Description |
---|---|
2010-05-12 | Name : Mac OS X Security Update 2007-009 File : nvt/macosx_secupd_2007-009.nasl |
2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
2009-10-10 | Name : SLES9: Security update for pcre File : nvt/sles9p5018729.nasl |
2009-10-10 | Name : SLES9: Security update for pcre File : nvt/sles9p5013426.nasl |
2009-10-10 | Name : SLES9: Security update for PHP4 File : nvt/sles9p5015662.nasl |
2009-10-10 | Name : SLES9: Security update for pcre File : nvt/sles9p5015818.nasl |
2009-04-09 | Name : Mandriva Update for pcre MDKSA-2007:211 (pcre) File : nvt/gb_mandriva_MDKSA_2007_211.nasl |
2009-04-09 | Name : Mandriva Update for pcre MDKSA-2007:212 (pcre) File : nvt/gb_mandriva_MDKSA_2007_212.nasl |
2009-03-23 | Name : Ubuntu Update for pcre3 vulnerabilities USN-547-1 File : nvt/gb_ubuntu_USN_547_1.nasl |
2009-03-06 | Name : RedHat Update for pcre RHSA-2007:1063-01 File : nvt/gb_RHSA-2007_1063-01_pcre.nasl |
2009-03-06 | Name : RedHat Update for pcre RHSA-2007:1065-01 File : nvt/gb_RHSA-2007_1065-01_pcre.nasl |
2009-03-06 | Name : RedHat Update for pcre RHSA-2007:1068-01 File : nvt/gb_RHSA-2007_1068-01_pcre.nasl |
2009-03-06 | Name : RedHat Update for php RHSA-2008:0546-01 File : nvt/gb_RHSA-2008_0546-01_php.nasl |
2009-02-27 | Name : CentOS Update for pcre CESA-2007:1065-01 centos2 i386 File : nvt/gb_CESA-2007_1065-01_pcre_centos2_i386.nasl |
2009-02-27 | Name : CentOS Update for php CESA-2008:0546-01 centos2 i386 File : nvt/gb_CESA-2008_0546-01_php_centos2_i386.nasl |
2009-02-27 | Name : CentOS Update for pcre CESA-2007:1063 centos3 x86_64 File : nvt/gb_CESA-2007_1063_pcre_centos3_x86_64.nasl |
2009-02-27 | Name : CentOS Update for pcre CESA-2007:1063 centos3 i386 File : nvt/gb_CESA-2007_1063_pcre_centos3_i386.nasl |
2009-02-16 | Name : Fedora Update for pcre FEDORA-2008-1842 File : nvt/gb_fedora_2008_1842_pcre_fc7.nasl |
2009-01-28 | Name : SuSE Update for pcre SUSE-SA:2007:062 File : nvt/gb_suse_2007_062.nasl |
2009-01-23 | Name : SuSE Update for php4, php5 SUSE-SA:2008:004 File : nvt/gb_suse_2008_004.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200801-18 (kazehakase) File : nvt/glsa_200801_18.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200801-19 (goffice) File : nvt/glsa_200801_19.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200805-11 (chicken) File : nvt/glsa_200805_11.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200801-02 (R) File : nvt/glsa_200801_02.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200711-30 (libpcre) File : nvt/glsa_200711_30.nasl |
2008-09-04 | Name : FreeBSD Ports: pcre, pcre-utf8 File : nvt/freebsd_pcre0.nasl |
2008-05-12 | Name : Debian Security Advisory DSA 1570-1 (kazehakase) File : nvt/deb_1570_1.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 1399-1 (pcre3) File : nvt/deb_1399_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
40764 | Perl-Compatible Regular Expression (PCRE) Character Class Calculation overflow |
40763 | Perl-Compatible Regular Expression (PCRE) Unmatched "\Q\E" Sequence... |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1068.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1063.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0968.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0967.nasl - Type : ACT_GATHER_INFO |
2013-06-29 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1068.nasl - Type : ACT_GATHER_INFO |
2013-03-06 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071129_pcre_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071105_pcre_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0967.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12049.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12000.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_11998.nasl - Type : ACT_GATHER_INFO |
2009-07-27 | Name : The remote VMware ESX host is missing one or more security-related patches. File : vmware_VMSA-2008-0007.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0968.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-211.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1063.nasl - Type : ACT_GATHER_INFO |
2008-07-16 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0546.nasl - Type : ACT_GATHER_INFO |
2008-05-09 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1570.nasl - Type : ACT_GATHER_INFO |
2008-03-19 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-002.nasl - Type : ACT_GATHER_INFO |
2008-03-07 | Name : The remote Fedora host is missing a security update. File : fedora_2008-1842.nasl - Type : ACT_GATHER_INFO |
2008-01-08 | Name : The remote openSUSE host is missing a security update. File : suse_apache2-mod_php5-4810.nasl - Type : ACT_GATHER_INFO |
2007-12-24 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-mod_php5-4808.nasl - Type : ACT_GATHER_INFO |
2007-12-18 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2007-009.nasl - Type : ACT_GATHER_INFO |
2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_pcre-4689.nasl - Type : ACT_GATHER_INFO |
2007-12-07 | Name : The remote openSUSE host is missing a security update. File : suse_glib2-4768.nasl - Type : ACT_GATHER_INFO |
2007-11-30 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1068.nasl - Type : ACT_GATHER_INFO |
2007-11-30 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1065.nasl - Type : ACT_GATHER_INFO |
2007-11-30 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1063.nasl - Type : ACT_GATHER_INFO |
2007-11-29 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-547-1.nasl - Type : ACT_GATHER_INFO |
2007-11-26 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200711-30.nasl - Type : ACT_GATHER_INFO |
2007-11-20 | Name : The remote openSUSE host is missing a security update. File : suse_pcre-4683.nasl - Type : ACT_GATHER_INFO |
2007-11-20 | Name : The remote openSUSE host is missing a security update. File : suse_pcre-4696.nasl - Type : ACT_GATHER_INFO |
2007-11-20 | Name : The remote openSUSE host is missing a security update. File : suse_pcre-4697.nasl - Type : ACT_GATHER_INFO |
2007-11-09 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-212.nasl - Type : ACT_GATHER_INFO |
2007-11-07 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_bfd6eef48c9411dc8c55001c2514716c.nasl - Type : ACT_GATHER_INFO |
2007-11-06 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1399.nasl - Type : ACT_GATHER_INFO |
2007-11-06 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0968.nasl - Type : ACT_GATHER_INFO |
2007-11-06 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0967.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:38:59 |
|