PT-2023-35639

Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description The issue is related to a global buffer overflow read. Technical details about the crash include the pcre get compiled regex cache ex function, php do pcre match function, and zif preg match...

php:php-fuzz-execute: Global-buffer-overflow in pcre_get_compiled_regex_cache_ex

Detailed Report: https://oss-fuzz.com/testcase?key=6703385533087744 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-execute Job Type: honggfuzzasanphp Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address: 0x0000014d13ea Crash State: pcregetcompiledregexcacheex...

php:php-fuzz-tracing-jit: Global-buffer-overflow in pcre_get_compiled_regex_cache_ex

Detailed Report: https://oss-fuzz.com/testcase?key=6258265952223232 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-tracing-jit Job Type: libfuzzerasanphp Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address: 0x0000014d13ed Crash State: pcregetcompiledregexcache...

Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by a vulnerabilty in PCRE (CVE-2015-3217)

Summary IBM Flex System Chassis Management Module CMM has addressed the following vulnerability in PCRE. Vulnerability Details CVEID: CVE-2015-3217 DESCRIPTION: PCRE is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the match function. By sending a...

Rocky Linux 8 : pcre2 (RLSA-2020:4539)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:4539 advisory. - An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode...

Rocky Linux 8 : pcre (RLSA-2021:4373)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4373 advisory. - libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related...

The vulnerability in the pcre2test command of the PCRE2 regular expression library allows a hacker to cause a service failure.

The vulnerability of the pcre2test command in the PCRE2 library is related to integer overflow. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Code injection

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP...

CVE-2023-41362

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP...

CVE-2023-41362: Improper Control of Generation of Code

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP...

CVE-2023-41362

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP...

CVE-2023-41362

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP...

Important Photon OS Security Update - PHSA-2023-5.0-91-0059

Updates of 'linux-esx', 'linux', 'pcre2', 'wireshark', 'linux-secure', 'linux-rt' packages of Photon OS have been released...

Amazon Linux AMI : glib2 (ALAS-2023-1775)

The version of glib2 installed on the remote host is prior to 2.36.3-5.26. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1775 advisory. Heap-based buffer overflow in the findfixedlength function in pcrecompile.c in PCRE before 8.38 allows remote attackers t...

Amazon Linux 2 : glib2 (ALAS-2023-2107)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2107 advisory. PCRE before 8.38 mishandles the : and \ substrings in character classes, which allows remote attackers to cause a denial of...

Medium: glib2

Issue Overview: PCRE before 8.38 mishandles the : and \ substrings in character classes, which allows remote attackers to cause a denial of service uninitialized memory read or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object...

Amazon Linux AMI : glib2 (ALAS-2023-1769)

The version of glib2 installed on the remote host is prior to 2.36.3-5.25. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1769 advisory. PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote...

Medium: glib2

Issue Overview: PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service buffer overflow or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a...

Amazon Linux AMI : pcre (ALAS-2023-1767)

The version of pcre installed on the remote host is prior to 8.21-7.9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1767 advisory. Heap-based buffer overflow in the findfixedlength function in pcrecompile.c in PCRE before 8.38 allows remote attackers to...

Medium: pcre

Issue Overview: Heap-based buffer overflow in the findfixedlength function in pcrecompile.c in PCRE before 8.38 allows remote attackers to cause a denial of service crash or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular...