An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.

🗓️ 26 May 2022 07:00:00Reported by MicrosoftType

mscve

mscve🔗 msrc.microsoft.com👁 5 Views

Out of bounds read in PCRE2 JIT unicode property matching due to incomplete caseless read.

Reporter	Title	Published	Views	Family All 152
IBM Security Bulletins	Security Bulletin:IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from openssl, pcre2 and Golang Go	31 Aug 202216:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Aspera Console has addressed multiple PCRE and PCRE2 library vulnerabilities (CVE-2022-1587, CVE-2019-20838, CVE-2022-1586)	29 May 202420:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	7 Jun 202316:53	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.7 contains fixes for multiple security vulnerabilities.	15 Dec 202209:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to CVE-2022-1586	7 Nov 202210:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Aspera Shares is vulnerable to multiple high severity vulnerabilities (CVE-2022-1586, CVE-2022-4304, CVE-2023-0215, CVE-2023-0286, CVE-2019-20838, CVE-2022-2068, CVE-2022-1587)	5 Feb 202517:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	27 Feb 202317:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in PCRE2 (CVE-2022-1586)	12 Jan 202321:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Aspera Orchestrator affected by vulnerability (CVE-2022-1586)	2 Feb 202320:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak	24 Oct 202220:10	–	ibm

Vulners

Node

microsoft cm1_pcre2_10.34-2Range<10.34-2

26 May 2022 07:00Current

7.2High risk

Vulners AI Score7.2

CVSS 26.4

CVSS 3.19.1

EPSS0.03378

pcre two out of bounds unicode property jit compilation caseless read matching path