Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 491
Alerts This Week
Warning Icon 1 491

Fedora 23: 2016-12035 Major: PCRE Security Update Implementation

fedora
Calendar Grey July 13, 2015
Scroller Fedora
Memory corruption vulnerabilities addressed in pcre for Fedora 22, enhancing both security and performance following this enhancement.
This release fixes two heap buffer overflows when compiling certain regular expressions: CVE-2015-3210 and CVE-2015-5073.

Summary

Perl-compatible regular expression library.

PCRE has its own native API, but a set of "wrapper" functions that are based on

the POSIX API are also supplied in the library libpcreposix. Note that this

just provides a POSIX calling interface to PCRE: the regular expressions

themselves still follow Perl syntax and semantics. The header file

for the POSIX-style functions is called pcreposix.h.

Update Information:

This release fixes two heap buffer overflows when compiling certain regular expressions: CVE-2015-3210 and CVE-2015-5073.

Topics%20covered

Topics Covered

security advisory Fedora heap overflow PCRE buffer fix

Change Log

* Wed Jul 1 2015 Petr Pisar - 8.37-2 - Fix CVE-2015-3210 (heap overflow when compiling an expression with named recursive back reference and the name is duplicated) (bug #1236659) - Fix CVE-2015-5073 (heap overflow when compiling an expression with an forward reference within backward asserion with excessive closing paranthesis) (bug #1237224)

References


[ 1 ] Bug #1226918 - CVE-2015-3210 pcre: heap buffer overflow in pcre_compile2() / compile_regex() https://bugzilla.redhat.com/show_bug.cgi?id=1226918 [ 2 ] Bug #1237223 - CVE-2015-5073 pcre: heap buffer overflow in find_fixedlength() https://bugzilla.redhat.com/show_bug.cgi?id=1237223

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update pcre' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
important
Lowest
Low
Medium
High
Critical

Name: pcre
Product: Fedora 22
Version: 8.37
Release: 2.fc22
URL:
Summary: Perl-compatible regular expression library

Topics%20covered

Topics Covered

security advisory Fedora heap overflow PCRE buffer fix

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.