CVE-2008-1026

2008-04-1719:05:00

CWE-119

[email protected]

web.nvd.nist.gov

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.5

Confidence

Low

EPSS

0.099

Percentile

94.9%

JSON

Integer overflow in the PCRE regular expression compiler (JavaScriptCore/pcre/pcre_compile.cpp) in Apple WebKit, as used in Safari before 3.1.1, allows remote attackers to execute arbitrary code via a regular expression with large, nested repetition counts, which triggers a heap-based buffer overflow.

Affected configurations

Nvd

Node

applemac_os_xMatch10.4.11

applemac_os_xMatch10.5.2

applemac_os_x_serverMatch10.4.11

applemac_os_x_serverMatch10.5.2

microsoftwindows_vista

microsoftwindows_xp

AND

applesafariMatch3

applesafariMatch3.1

VendorProductVersionCPE
applemac_os_x10.4.11cpe:2.3:o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*
applemac_os_x10.5.2cpe:2.3:o:apple:mac_os_x:10.5.2:*:*:*:*:*:*:*
applemac_os_x_server10.4.11cpe:2.3:o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*
applemac_os_x_server10.5.2cpe:2.3:o:apple:mac_os_x_server:10.5.2:*:*:*:*:*:*:*
microsoftwindows_vista*cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:*:*:*:*:*:*:*
applesafari3cpe:2.3:a:apple:safari:3:*:*:*:*:*:*:*
applesafari3.1cpe:2.3:a:apple:safari:3.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	mac_os_x	10.4.11	cpe:2.3:o:apple:mac_os_x:10.4.11:::::::*
apple	mac_os_x	10.5.2	cpe:2.3:o:apple:mac_os_x:10.5.2:::::::*
apple	mac_os_x_server	10.4.11	cpe:2.3:o:apple:mac_os_x_server:10.4.11:::::::*
apple	mac_os_x_server	10.5.2	cpe:2.3:o:apple:mac_os_x_server:10.5.2:::::::*
microsoft	windows_vista	*	cpe:2.3:o:microsoft:windows_vista::::::::
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp::::::::
apple	safari	3	cpe:2.3:a:apple:safari:3:::::::*
apple	safari	3.1	cpe:2.3:a:apple:safari:3.1:::::::*