USN-2694-1 pcre3 vulnerabilities

Michele Spagnuolo discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. CVE-2014-8964...

Google Chrome V8 Denial of Service Vulnerability (CNVD-2015-04888)

Google Chrome is the United States Google Google company developed a Web browser. Google V8 is one of the open source JavaScript engine. A security vulnerability exists in the regular-expression implementation of Google V8 used in versions of Google Chrome prior to 44.0.2403.89, which stems from ...

Stack overflow

The regular-expression implementation in Google V8, as used in Google Chrome before 44.0.2403.89, mishandles interrupts, which allows remote attackers to cause a denial of service application crash via crafted JavaScript code, as demonstrated by an error in garbage collection during allocation of...

rack-cors Gem Missing Anchor permits unauthorized CORS requests

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net as well as...

unicode.org XSS vulnerability

Vulnerable URL: http://unicode.org/cldr/utility/regex.jsp?a=\pNd%2B%28%5B%5B%3AWB%3DMB%3A%5D%5B%3AWB%3DMN%3A%5D%5D\pNd%2B%29%3F%22%3E%3Csvg%2Fonload%3Dalert%28%2Fxssposed%2F%29%3E=The+35+quick+brown+fox+jumped+over+1.234+lazy+dogs%3A+1%3A234. Details: Description| Value ---|--- Patched:| No Lates...

CVE-2015-5144

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an 1 email message to the EmailValidator, a ...

SOL16831 - BSD regex library vulnerability CVE-2015-2305

Note: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles published before this date do not list a Severity value. Recommended Action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL995...

UBUNTU-CVE-2015-5073

Heap-based buffer overflow in the findfixedlength function in pcrecompile.c in PCRE before 8.38 allows remote attackers to cause a denial of service crash or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an...

PCRE 'compile_branch()' function heap buffer overflow vulnerability

PCRE Perl Compatible Regular Expressions is a software developer Philip Hazel developed a use of C language written in open source regular expression library. PCRE suffers from a heap buffer overflow vulnerability in compilebranch. This vulnerability allows an attacker to execute arbitrary code i...

SUSE SLES11 Security Update : php53 (SUSE-SU-2015:1018-1)

PHP 5.3 was updated to fix multiple security issues : bnc931776: pcntlexec does not check path validity CVE-2015-4026 bnc931772: overflow in ftpgenlist resulting in heap overflow CVE-2015-4022 bnc931769: memory corruption in pharparsetarfile when entry filename starts with NULL CVE-2015-4021...

PCRE 'compile_regex()' function heap buffer overflow vulnerability

PCRE Perl Compatible Regular Expressions is a software developer Philip Hazel developed a use of C language written in open source regular expression library. A heap buffer overflow vulnerability exists in the PCRE 'compileregex' function. This vulnerability could be exploited by an attacker to...

PCRE 'compile_regex()' Buffer Overflow Vulnerability

PCRE Perl Compatible Regular Expressions is a software developer Philip Hazel developed a use of C language written in open source regular expression library. A buffer overflow vulnerability exists in PCRE 'compileregex'. This allows attackers to exploit the vulnerability to execute arbitrary cod...

regex: heap overflow in regcomp() on 32-bit architectures

A heap buffer overflow flaw was found in the regcomp function of Henry Spencer's regular expression library. An attacker able to make an application process a specially crafted regular expression pattern with the regcomp function could cause that application to crash and possibly execute arbitrar...

regex: heap overflow in regcomp() on 32-bit architectures

A heap buffer overflow flaw was found in the regcomp function of Henry Spencer's regular expression library. An attacker able to make an application process a specially crafted regular expression pattern with the regcomp function could cause that application to crash and possibly execute arbitrar...

UBUNTU-CVE-2015-3210

Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^?P=B?P=B?J:?Pc?Pa?P=BWGXCREDITS/, a different vulnerability than CVE-2015-8384...

Medium: php

Issue Overview: Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library aka rxspencer alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression...

Fedora 20 : clamav-0.98.7-1.fc20 (2015-7378)

ClamAV 0.98.7 ============= This release contains new scanning features and bug fixes. - Improvements to PDF processing: decryption, escape sequence handling, and file property collection. - Scanning/analysis of additional Microsoft Office 2003 XML format. - Fix infinite loop condition on crafted...

ClamAV < 0.98.7 Multiple Vulnerabilities

According to its version, the ClamAV clamd antivirus daemon on the remote host is prior to 0.98.7. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the pefromupx function in upx.c. A remote attacker can exploit this flaw, via a specially crafted file, to...

MGASA-2015-0190 Updated clamav packages fix security vulnerabilities

This updates fixes the following security issues: Fix infinite loop condition on crafted y0da cryptor file. Identified and patch suggested by Sebastian Andrzej Siewior. CVE-2015-2221 Fix crash on crafted petite packed file. Reported and patch supplied by Sebastian Andrzej Siewior. CVE-2015-2222...

Mandriva Linux Security Advisory : clamav (MDVSA-2015:221)

Multiple vulnerabilities has been found and corrected in clamav : Fix infinite loop condition on crafted y0da cryptor file. Identified and patch suggested by Sebastian Andrzej Siewior CVE-2015-2221. Fix crash on crafted petite packed file. Reported and patch supplied by Sebastian Andrzej Siewior...