Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate the amount of memory needed for a compiled regular expression pattern when the (1) -x or (2) -i UTF-8 options change within the pattern, which allows context-dependent attackers to cause a denial of service (PCRE or glibc crash) via crafted regular expressions.

From Red Hat Security Advisory 2007:1068 :

Updated pcre packages that resolve several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PCRE is a Perl-compatible regular expression library.

Flaws were discovered in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parses a malicious regular expression, it may have been possible to run arbitrary code as the user running the application.
(CVE-2006-7225, CVE-2006-7226, CVE-2006-7228, CVE-2006-7230, CVE-2007-1659)

Users of PCRE are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Red Hat would like to thank Ludwig Nussel for reporting these issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-1059 advisory.

    [6.6-2.7]
     - Fix the names of the patches added in 6.6-2.5:
       mv pcre-6.4-posix.diff pcre-6.6-CVE-2006-7225.patch        mv pcre-6.4-fix1.patch pcre-6.6-CVE-2006-7226.patch
     - Update pcre-6.6-CVE-2007-1659.patch
     - Update pcre-6.6-CVE-2007-1660.patch
     - Add pcre-6.6-CVE-2006-7230.patch
     - Resolves: #380531

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated pcre packages that resolve several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PCRE is a Perl-compatible regular expression library.

Flaws were discovered in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parses a malicious regular expression, it may have been possible to run arbitrary code as the user running the application.
(CVE-2006-7225, CVE-2006-7226, CVE-2006-7228, CVE-2006-7230, CVE-2007-1659)

Users of PCRE are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Red Hat would like to thank Ludwig Nussel for reporting these issues.

Flaws were discovered in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parsed a malicious regular expression, it may have been possible to run arbitrary code as the user running the application.
(CVE-2006-7225, CVE-2006-7226, CVE-2006-7228, CVE-2006-7230, CVE-2007-1660)

This update fixes multiple bugs in php :

  - several problems in pcre (CVE-2007-1660, CVE-2006-7225,     CVE-2006-7224, CVE-2006-7226 CVE-2007-1659,     CVE-2006-7230)

  - Flaws in processing multi byte sequences in     htmlentities/htmlspecialchars. (CVE-2007-5898)

  - overly long arguments to the dl() function could crash     php. (CVE-2007-4825)

  - overy long arguments to the glob() function could crash     php. (CVE-2007-4782)

  - overly long arguments to some iconv functions could     crash php. (CVE-2007-4840)

  - overy long arguments to the setlocale() function could     crash php. (CVE-2007-4784)

  - the wordwrap-Function could cause a floating point     exception. (CVE-2007-3998)

  - overy long arguments to the fnmatch() function could     crash php. (CVE-2007-4782)

  - incorrect size calculation in the chunk_split function     could lead to a buffer overflow. (CVE-2007-4661,     CVE-2007-2872)

  - Flaws in the GD extension could lead to integer     overflows. (CVE-2007-3996)

  - The money_format function contained format string flaws.
    (CVE-2007-4658)

Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code. (CVE-2007-1659, CVE-2006-7230)

Multiple vulnerabilities were discovered by Tavis Ormandy and Will Drewry in the way that pcre handled certain malformed regular expressions. If an application linked against pcre, such as Konqueror, parses a malicious regular expression, it could lead to the execution of arbitrary code as the user running the application.

Updated packages have been patched to prevent this issue.

Andrews Salomon reported that kazehakase, a GTK+-based web browser that allows pluggable rendering engines, contained an embedded copy of the PCRE library in its source tree which was compiled in and used in preference to the system-wide version of this library.

The PCRE library has been updated to fix the security issues reported against it in previous Debian Security Advisories. This update ensures that kazehakase uses that supported library, and not its own embedded and insecure version.

Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code (CVE-2006-7230).

This update fixes multiple bugs in php :

  - use system pcre library to fix several pcre     vulnerabilities (CVE-2007-1659, CVE-2006-7230,     CVE-2007-1660, CVE-2006-7227 CVE-2005-4872,     CVE-2006-7228)

  - Flaws in processing multi byte sequences in     htmlentities/htmlspecialchars (CVE-2007-5898)

  - overly long arguments to the dl() function could crash     php (CVE-2007-4825)

  - overy long arguments to the glob() function could crash     php (CVE-2007-4782)

  - overly long arguments to some iconv functions could     crash php (CVE-2007-4840)

  - overy long arguments to the setlocale() function could     crash php (CVE-2007-4784)

  - the wordwrap-Function could cause a floating point     exception (CVE-2007-3998)

  - overy long arguments to the fnmatch() function could     crash php (CVE-2007-4782)

  - incorrect size calculation in the chunk_split function     could lead to a buffer overflow (CVE-2007-4661)

  - Flaws in the GD extension could lead to integer     overflows (CVE-2007-3996)

  - The money_format function contained format string flaws     (CVE-2007-4658)

  - Data for some time zones has been updated

This update fixes multiple bugs in php :

  - use system pcre library to fix several pcre     vulnerabilities. (CVE-2007-1659 / CVE-2006-7230 /     CVE-2007-1660 / CVE-2006-7227 / CVE-2005-4872 /     CVE-2006-7228)

  - Flaws in processing multi byte sequences in     htmlentities/htmlspecialchars. (CVE-2007-5898)

  - overly long arguments to the dl() function could crash     php. (CVE-2007-4825)

  - overy long arguments to the glob() function could crash     php. (CVE-2007-4782)

  - overly long arguments to some iconv functions could     crash php. (CVE-2007-4840)

  - overy long arguments to the setlocale() function could     crash php. (CVE-2007-4784)

  - the wordwrap-Function could cause a floating point     exception. (CVE-2007-3998)

  - overy long arguments to the fnmatch() function could     crash php. (CVE-2007-4782)

  - incorrect size calculation in the chunk_split function     could lead to a buffer overflow. (CVE-2007-4661)

  - Flaws in the GD extension could lead to integer     overflows. (CVE-2007-3996)

  - The money_format function contained format string flaws.
    (CVE-2007-4658)

  - Data for some time zones has been updated

Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code. (CVE-2006-7230)

Updated pcre packages that resolve several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PCRE is a Perl-compatible regular expression library.

Flaws were discovered in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parses a malicious regular expression, it may have been possible to run arbitrary code as the user running the application.
(CVE-2006-7225, CVE-2006-7226, CVE-2006-7228, CVE-2006-7230)

Users of PCRE are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Red Hat would like to thank Ludwig Nussel for reporting these issues.

The remote host is affected by the vulnerability described in GLSA-200711-30 (PCRE: Multiple vulnerabilities)

    Tavis Ormandy (Google Security) discovered multiple vulnerabilities in     PCRE. He reported an error when processing '\\Q\\E' sequences with     unmatched '\\E' codes that can lead to the compiled bytecode being     corrupted (CVE-2007-1659). PCRE does not properly calculate sizes for     unspecified 'multiple forms of character class', which triggers a     buffer overflow (CVE-2007-1660). Further improper calculations of     memory boundaries were reported when matching certain input bytes     against regex patterns in non UTF-8 mode (CVE-2007-1661) and when     searching for unmatched brackets or parentheses (CVE-2007-1662).
    Multiple integer overflows when processing escape sequences may lead to     invalid memory read operations or potentially cause heap-based buffer     overflows (CVE-2007-4766). PCRE does not properly handle '\\P' and     '\\P{x}' sequences which can lead to heap-based buffer overflows or     trigger the execution of infinite loops (CVE-2007-4767), PCRE is also     prone to an error when optimizing character classes containing a     singleton UTF-8 sequence which might lead to a heap-based buffer     overflow (CVE-2007-4768).
    Chris Evans also reported multiple integer overflow vulnerabilities in     PCRE when processing a large number of named subpatterns ('name_count')     or long subpattern names ('max_name_size') (CVE-2006-7227), and via     large 'min', 'max', or 'duplength' values (CVE-2006-7228) both possibly     leading to buffer overflows. Another vulnerability was reported when     compiling patterns where the '-x' or '-i' UTF-8 options change within     the pattern, which might lead to improper memory calculations     (CVE-2006-7230).
  Impact :

    An attacker could exploit these vulnerabilities by sending specially     crafted regular expressions to applications making use of the PCRE     library, which could possibly lead to the execution of arbitrary code,     a Denial of Service or the disclosure of sensitive information.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities were discovered by Tavis Ormandy and Will Drewry in the way that pcre handled certain malformed regular expressions. If an application linked against pcre, such as Konqueror, parses a malicious regular expression, it could lead to the execution of arbitrary code as the user running the application.

Updated packages have been patched to prevent this issue.
Additionally, Corporate Server 4.0 was updated to pcre version 6.7 which corrected CVE-2006-7225, CVE-2006-7226, CVE-2006-7227, CVE-2006-7228, and CVE-2006-7230.

ID	Name	Product	Family	Severity
67613	Oracle Linux 4 : pcre (ELSA-2007-1068)	Nessus	Oracle Linux Local Security Checks	medium
67611	Oracle Linux 5 : Important: / pcre (ELSA-2007-1059)	Nessus	Oracle Linux Local Security Checks	high
67061	CentOS 4 : pcre (CESA-2007:1068)	Nessus	CentOS Local Security Checks	medium
65042	Scientific Linux Security Update : pcre on SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41187	SuSE9 Security Update : PHP4 (YOU Patch Number 12049)	Nessus	SuSE Local Security Checks	high
41169	SuSE9 Security Update : pcre (YOU Patch Number 11998)	Nessus	SuSE Local Security Checks	medium
37237	Mandrake Linux Security Advisory : pcre (MDKSA-2007:211)	Nessus	Mandriva Local Security Checks	high
32144	Debian DSA-1570-1 : kazehakase - various	Nessus	Debian Local Security Checks	high
29886	openSUSE 10 Security Update : pcre (pcre-4750)	Nessus	SuSE Local Security Checks	medium
29885	openSUSE 10 Security Update : pcre (pcre-4708)	Nessus	SuSE Local Security Checks	medium
29878	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-4810)	Nessus	SuSE Local Security Checks	high
29780	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 4808)	Nessus	SuSE Local Security Checks	high
29549	SuSE 10 Security Update : pcre (ZYPP Patch Number 4748)	Nessus	SuSE Local Security Checks	medium
29548	SuSE 10 Security Update : pcre (ZYPP Patch Number 4707)	Nessus	SuSE Local Security Checks	medium
28367	RHEL 4 : pcre (RHSA-2007:1068)	Nessus	Red Hat Local Security Checks	medium
28364	RHEL 5 : pcre (RHSA-2007:1059)	Nessus	Red Hat Local Security Checks	medium
28319	GLSA-200711-30 : PCRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
27849	Mandrake Linux Security Advisory : pcre (MDKSA-2007:212)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2006-7230

high

Tenable Plugins

medium

high

medium

medium

high

medium

high

high

medium

medium

high

high

medium

medium

medium

medium

high

high