- ---------------------------------------------------------------------                   Red Hat Security Advisory

Synopsis:          Important: pcre security update
Advisory ID:       RHSA-2007:1063-01
Advisory URL:      https://access.redhat.com/errata/RHSA-2007:1063.html
Issue date:        2007-11-29
Updated on:        2007-11-29
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2006-7228 CVE-2007-1660 
- ---------------------------------------------------------------------1. Summary:

Updated pcre packages that resolve several security issues are now
available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Problem description:

PCRE is a Perl-compatible regular expression library.

Flaws were discovered in the way PCRE handles certain malformed regular
expressions.  If an application linked against PCRE, such as Konqueror,
parsed a malicious regular expression, it may have been possible to run
arbitrary code as the user running the application. (CVE-2006-7228,
CVE-2007-1660)

Users of PCRE are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues.

Red Hat would like to thank Ludwig Nussel for reporting these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at

5. Bug IDs fixed (http://bugzilla.redhat.com/):

315881 - CVE-2007-1660 pcre regular expression flaws
383371 - CVE-2006-7228 pcre integer overflow

6. RPMs required:

Red Hat Enterprise Linux AS version 3:

SRPMS:
44ea64b64fa610c91ae055878e4e8085  pcre-3.9-10.4.src.rpm

i386:
95779554a24650e24d757e764aa74f25  pcre-3.9-10.4.i386.rpm
56c96fa950f63b46658ecbcedecb4dd1  pcre-debuginfo-3.9-10.4.i386.rpm
e9ea2e70165ac3d7e95249ccd16a9983  pcre-devel-3.9-10.4.i386.rpm

ia64:
95779554a24650e24d757e764aa74f25  pcre-3.9-10.4.i386.rpm
fd7349f54aceb88dcd86b267f812bafc  pcre-3.9-10.4.ia64.rpm
56c96fa950f63b46658ecbcedecb4dd1  pcre-debuginfo-3.9-10.4.i386.rpm
f9c1e6ff16151dc24ae22b51ab0c79f2  pcre-debuginfo-3.9-10.4.ia64.rpm
721a7dfcd642f66fcbcc2ac04afdb8bb  pcre-devel-3.9-10.4.ia64.rpm

ppc:
adf37fe2c059c2cfe6a0f4f844603e29  pcre-3.9-10.4.ppc.rpm
4c1c16803cb4ae09a5242d059d51658b  pcre-3.9-10.4.ppc64.rpm
81c5a80144897a28c1d28a3a590c3f88  pcre-debuginfo-3.9-10.4.ppc.rpm
605e239ef723907e2d4bdb359886d809  pcre-debuginfo-3.9-10.4.ppc64.rpm
faa3350c0417e79165768dafa44fd495  pcre-devel-3.9-10.4.ppc.rpm

s390:
432d71cf2022271a823ead5d9549504f  pcre-3.9-10.4.s390.rpm
2939c20c7b5fa5cb63bb8d12fa23f3bc  pcre-debuginfo-3.9-10.4.s390.rpm
ebf139993b5ee8f90d1668acf229d202  pcre-devel-3.9-10.4.s390.rpm

s390x:
432d71cf2022271a823ead5d9549504f  pcre-3.9-10.4.s390.rpm
3a808e46628e79d79c7e808aacc44c15  pcre-3.9-10.4.s390x.rpm
2939c20c7b5fa5cb63bb8d12fa23f3bc  pcre-debuginfo-3.9-10.4.s390.rpm
91e8e1fa0791367d99d051eecc0b9179  pcre-debuginfo-3.9-10.4.s390x.rpm
24b9c346b9c686fe3cf12768673bab18  pcre-devel-3.9-10.4.s390x.rpm

x86_64:
95779554a24650e24d757e764aa74f25  pcre-3.9-10.4.i386.rpm
0d5e674d6622efd83c07fdcd16ba3dc2  pcre-3.9-10.4.x86_64.rpm
56c96fa950f63b46658ecbcedecb4dd1  pcre-debuginfo-3.9-10.4.i386.rpm
dd121878136f47104359f54deb77b0dd  pcre-debuginfo-3.9-10.4.x86_64.rpm
b6d06e7efdfd9ed8b35a15b1370808c6  pcre-devel-3.9-10.4.x86_64.rpm

Red Hat Desktop version 3:

SRPMS:
44ea64b64fa610c91ae055878e4e8085  pcre-3.9-10.4.src.rpm

i386:
95779554a24650e24d757e764aa74f25  pcre-3.9-10.4.i386.rpm
56c96fa950f63b46658ecbcedecb4dd1  pcre-debuginfo-3.9-10.4.i386.rpm
e9ea2e70165ac3d7e95249ccd16a9983  pcre-devel-3.9-10.4.i386.rpm

x86_64:
95779554a24650e24d757e764aa74f25  pcre-3.9-10.4.i386.rpm
0d5e674d6622efd83c07fdcd16ba3dc2  pcre-3.9-10.4.x86_64.rpm
56c96fa950f63b46658ecbcedecb4dd1  pcre-debuginfo-3.9-10.4.i386.rpm
dd121878136f47104359f54deb77b0dd  pcre-debuginfo-3.9-10.4.x86_64.rpm
b6d06e7efdfd9ed8b35a15b1370808c6  pcre-devel-3.9-10.4.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
44ea64b64fa610c91ae055878e4e8085  pcre-3.9-10.4.src.rpm

i386:
95779554a24650e24d757e764aa74f25  pcre-3.9-10.4.i386.rpm
56c96fa950f63b46658ecbcedecb4dd1  pcre-debuginfo-3.9-10.4.i386.rpm
e9ea2e70165ac3d7e95249ccd16a9983  pcre-devel-3.9-10.4.i386.rpm

ia64:
95779554a24650e24d757e764aa74f25  pcre-3.9-10.4.i386.rpm
fd7349f54aceb88dcd86b267f812bafc  pcre-3.9-10.4.ia64.rpm
56c96fa950f63b46658ecbcedecb4dd1  pcre-debuginfo-3.9-10.4.i386.rpm
f9c1e6ff16151dc24ae22b51ab0c79f2  pcre-debuginfo-3.9-10.4.ia64.rpm
721a7dfcd642f66fcbcc2ac04afdb8bb  pcre-devel-3.9-10.4.ia64.rpm

x86_64:
95779554a24650e24d757e764aa74f25  pcre-3.9-10.4.i386.rpm
0d5e674d6622efd83c07fdcd16ba3dc2  pcre-3.9-10.4.x86_64.rpm
56c96fa950f63b46658ecbcedecb4dd1  pcre-debuginfo-3.9-10.4.i386.rpm
dd121878136f47104359f54deb77b0dd  pcre-debuginfo-3.9-10.4.x86_64.rpm
b6d06e7efdfd9ed8b35a15b1370808c6  pcre-devel-3.9-10.4.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS:
44ea64b64fa610c91ae055878e4e8085  pcre-3.9-10.4.src.rpm

i386:
95779554a24650e24d757e764aa74f25  pcre-3.9-10.4.i386.rpm
56c96fa950f63b46658ecbcedecb4dd1  pcre-debuginfo-3.9-10.4.i386.rpm
e9ea2e70165ac3d7e95249ccd16a9983  pcre-devel-3.9-10.4.i386.rpm

ia64:
95779554a24650e24d757e764aa74f25  pcre-3.9-10.4.i386.rpm
fd7349f54aceb88dcd86b267f812bafc  pcre-3.9-10.4.ia64.rpm
56c96fa950f63b46658ecbcedecb4dd1  pcre-debuginfo-3.9-10.4.i386.rpm
f9c1e6ff16151dc24ae22b51ab0c79f2  pcre-debuginfo-3.9-10.4.ia64.rpm
721a7dfcd642f66fcbcc2ac04afdb8bb  pcre-devel-3.9-10.4.ia64.rpm

x86_64:
95779554a24650e24d757e764aa74f25  pcre-3.9-10.4.i386.rpm
0d5e674d6622efd83c07fdcd16ba3dc2  pcre-3.9-10.4.x86_64.rpm
56c96fa950f63b46658ecbcedecb4dd1  pcre-debuginfo-3.9-10.4.i386.rpm
dd121878136f47104359f54deb77b0dd  pcre-debuginfo-3.9-10.4.x86_64.rpm
b6d06e7efdfd9ed8b35a15b1370808c6  pcre-devel-3.9-10.4.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7228
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1660
http://www.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is .  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.