Updated pcre packages that resolve several security issues are now available for Red Hat Enterprise Linux 2.1. Flaws were discovered in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE parses a malicious regular expression, it may have been possible to run arbitrary code as the user running the application. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

- ---------------------------------------------------------------------                   Red Hat Security Advisory

Synopsis:          Moderate: pcre security update
Advisory ID:       RHSA-2007:1065-01
Advisory URL:      https://access.redhat.com/errata/RHSA-2007:1065.html
Issue date:        2007-11-29
Updated on:        2007-11-29
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2006-7228 CVE-2007-1660 
- ---------------------------------------------------------------------1. Summary:

Updated pcre packages that resolve several security issues are now
available for Red Hat Enterprise Linux 2.1.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1  - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386

3. Problem description:

PCRE is a Perl-compatible regular expression library.

Flaws were discovered in the way PCRE handles certain malformed regular
expressions. If an application linked against PCRE parses a malicious
regular expression, it may have been possible to run arbitrary code as the
user running the application. (CVE-2006-7228, CVE-2007-1660)

Users of PCRE are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues.

Red Hat would like to thank Ludwig Nussel for reporting these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at

5. Bug IDs fixed (https://bugzilla.redhat.com/):

315881 - CVE-2007-1660 pcre regular expression flaws
383371 - CVE-2006-7228 pcre integer overflow

6. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 :

SRPMS:
b022b4a160b9ae10502caf8f7f41e3df  pcre-3.4-2.4.src.rpm

i386:
93b438935eef79a4694bce231c88677d  pcre-3.4-2.4.i386.rpm
ba0028614c709b8890fa2df7f943a6ec  pcre-devel-3.4-2.4.i386.rpm

ia64:
cdcd3056392e75214d16493b9e3a5cf5  pcre-3.4-2.4.ia64.rpm
bb8cf92b2f4f9a24653116e027a5ee2a  pcre-devel-3.4-2.4.ia64.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS:
b022b4a160b9ae10502caf8f7f41e3df  pcre-3.4-2.4.src.rpm

ia64:
cdcd3056392e75214d16493b9e3a5cf5  pcre-3.4-2.4.ia64.rpm
bb8cf92b2f4f9a24653116e027a5ee2a  pcre-devel-3.4-2.4.ia64.rpm

Red Hat Enterprise Linux ES version 2.1:

SRPMS:
b022b4a160b9ae10502caf8f7f41e3df  pcre-3.4-2.4.src.rpm

i386:
93b438935eef79a4694bce231c88677d  pcre-3.4-2.4.i386.rpm
ba0028614c709b8890fa2df7f943a6ec  pcre-devel-3.4-2.4.i386.rpm

Red Hat Enterprise Linux WS version 2.1:

SRPMS:
b022b4a160b9ae10502caf8f7f41e3df  pcre-3.4-2.4.src.rpm

i386:
93b438935eef79a4694bce231c88677d  pcre-3.4-2.4.i386.rpm
ba0028614c709b8890fa2df7f943a6ec  pcre-devel-3.4-2.4.i386.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.cve.org/CVERecord?id=CVE-2006-7228
https://www.cve.org/CVERecord?id=CVE-2007-1660
https://access.redhat.com/security/updates/classification#moderate

8. Contact:

The Red Hat security contact is .  More contact
details at https://access.redhat.com/security/team/contact

Copyright 2007 Red Hat, Inc.