libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service
    (segmentation violation for read access, and application crash) by triggering an invalid Unicode property
    lookup. (CVE-2017-7186)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service     (segmentation violation for read access, and application crash) by triggering an invalid Unicode property     lookup. (CVE-2017-7186)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5665-1 advisory.

    It was discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use     this issue to cause applications using PCRE to crash, resulting in a denial of service. (CVE-2017-6004)

    It was discovered that PCRE incorrectly handled certain Unicode encoding. A remote attacker could use this     issue to cause applications using PCRE to crash, resulting in a denial of service. (CVE-2017-7186)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3652-1 advisory.

    Update pcre to version 8.45:

    - CVE-2020-14155: Fixed integer overflow via a large number after a '(?C' substring (bsc#1172974).
    - CVE-2019-20838: Fixed buffer over-read in JIT compiler (bsc#1172973).
    - CVE-2017-7244: Fixed invalid read in _pcre32_xclass() (bsc#1030807).
    - CVE-2017-7245: Fixed buffer overflow in the pcre32_copy_substring (bsc#1030805).
    - CVE-2017-7246: Fixed another buffer overflow in the pcre32_copy_substring (bsc#1030803).
    - CVE-2017-7186: Fixed denial of service caused by an invalid Unicode property lookup (bsc#1030066).
    - CVE-2017-6004: Fixed denial of service via crafted regular expression (bsc#1025709).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the pcre packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow     remote attackers to cause a denial of service     (segmentation violation for read access, and     application crash) by triggering an invalid Unicode     property lookup.(CVE-2017-7186)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the pcre packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow     remote attackers to cause a denial of service     (segmentation violation for read access, and     application crash) by triggering an invalid Unicode     property lookup.(CVE-2017-7186)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- update to 2.56.x

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201710-25 (PCRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in The PCRE Library.
      Please review the references below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition or       other unspecified impacts via a specially crafted file.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201710-09 (PCRE2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PCRE2. Please review       the referenced CVE identifiers for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or have       other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

This release fixes a crash when finding a Unicode property for a character with a code point greater than 0x10ffff in UTF-32 library while UTF mode is disabled and JIT mode is enabled. It also fixes an incortect cast in UTF validation routine.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This release fixes a crash when finding a Unicode property for a character with a code point greater than 0x10ffff in UTF-32 library while UTF mode is disabled and JIT mde enabled. It also fixes a buffer overlflow in pcretest tool when copying a string in UTF-32 mode.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
424334	Alpine: multiple libpcre16 packages, multiple pcre packages: security update to 8.40-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
424334	Alpine: multiple libpcre16 packages, multiple pcre packages: security update to 8.40-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
221604	Linux Distros Unpatched Vulnerability : CVE-2017-7186	Nessus	Misc.	Local	high
400899	Alpine: multiple libpcre16 packages, multiple pcre packages: security update to 8.40-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
400899	Alpine: multiple libpcre16 packages, multiple pcre packages: security update to 8.40-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
166014	Ubuntu 16.04 ESM : PCRE vulnerabilities (USN-5665-1)	Nessus	Ubuntu Local Security Checks	Local	high
155134	SUSE SLED12: libpcre1 / libpcre1-32bit / libpcre16-0 / libpcrecpp0 / etc (SUSE-SU-2021:3652-1)	Nessus	SuSE Local Security Checks	Local	high
128934	EulerOS Virtualization for ARM 64 3.0.2.0 : pcre (EulerOS-SA-2019-1931)	Nessus	Huawei Local Security Checks	Local	high
128094	EulerOS 2.0 SP5 : pcre (EulerOS-SA-2019-1802)	Nessus	Huawei Local Security Checks	Local	high
123111	EulerOS 2.0 SP3 : pcre (EulerOS-SA-2019-1098)	Nessus	Huawei Local Security Checks	Local	high
120337	Fedora 28 : mingw-glib2 / mingw-glibmm24 (2018-3238d4da59)	Nessus	Fedora Local Security Checks	Local	high
104068	GLSA-201710-25 : PCRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
103727	GLSA-201710-09 : PCRE2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
101738	Fedora 26 : pcre2 (2017-e4c6ab648b)	Nessus	Fedora Local Security Checks	Local	high
101579	Fedora 26 : pcre (2017-188135cba8)	Nessus	Fedora Local Security Checks	Local	high
100073	Fedora 24 : pcre (2017-3b367c896f)	Nessus	Fedora Local Security Checks	Local	high
99696	Fedora 24 : pcre2 (2017-2c4ddb3ca2)	Nessus	Fedora Local Security Checks	Local	high
99645	Fedora 25 : pcre (2017-b4d4a46af6)	Nessus	Fedora Local Security Checks	Local	high
99612	Fedora 25 : pcre2 (2017-9c6430c2e2)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2017-7186

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high