CVE-2017-9225

Oniguruma 6.2.0 (as used in Ruby via oniguruma-mod through Ruby 2.4.1 and mbstring in PHP through 7.1.5) contains CVE-2017-9225, a stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() and related unicode handling, with Code point 0xFFFFFFFF not properly handled in unicode_unf...

CVE-2017-9226

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in nextstateval during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetchtoken and...

CVE-2017-9229

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in leftadjustcharhead during regular expression compilation. Invalid handling of reg-dmax in forwardsearchrange could result in an invalid pointer...

CVE-2017-9226

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in nextstateval during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetchtoken and...

CVE-2017-9228

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitsetsetrange during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect...

CVE-2017-9224

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in matchat during regular expression searching. A logical error involving order of validation and access in matchat could result in an...

CVE-2017-9228

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitsetsetrange during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect...

CVE-2017-9226

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in nextstateval during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetchtoken and...

CVE-2017-9224

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in matchat during regular expression searching. A logical error involving order of validation and access in matchat could result in an...

Multiple Cross-Site Request Forgery Vulnerabilities in Simple Invoices

Simple Invoices is an open source, free web-based invoicing system. Three cross-site request forgery vulnerabilities exist in Simple Invoices version 2013.1.beta.8. A remote attacker can use these vulnerabilities to create a new administrator user account and take control of the entire applicatio...

Regular Expression Denial Of Service (ReDoS)

amqp-match is vulnerable to regular expression denial of service ReDoS attacks. These attacks can be triggered when the .match function is used to identify routing tokens in a long string...

[SECURITY] Fedora 24 Update: pcre-8.40-7.fc24

PCRE, Perl-compatible regular expression, library has its own native API, b ut a set of wrapper functions that are based on the POSIX API are also supplied in the libpcreposix library. Note that this just provides a POSIX calling interface to PCRE: the regular expressions themselves still follow...

PCRE2 Buffer Overflow Vulnerability (CNVD-2017-06216)

PCRE2 is an API for modifying PCRE Open Source Regular Expression Library developed by software developer Philip Hazel. A heap buffer overflow vulnerability exists in the pcre2test.c file in PCRE2 version 10.23. A remote attacker could exploit this vulnerability to cause a denial of service with...

Paragon Initiative Enterprises: Improper validation of Email

1.goto https://bridge.cspr.ng/my/account here no rate limit present for email and display name,real name i just entered 1000 character length email in email field and it accepted also for the display name ,real name another there is no regular expression to check valid email if u give email as...

Heap overflow

pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted regular expression...

CVE-2017-8786

pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted regular expression...

CVE-2017-8786

pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted regular expression...

PCRE2 Buffer Overflow Vulnerability (CNVD-2017-07003)

PCRE2 is an API for modifying PCRE Open Source Regular Expression Library developed by software developer Philip Hazel. A buffer overflow vulnerability exists in the pcre2match.c file in versions of PCRE2 prior to 2017-03-10. An attacker can exploit this vulnerability to cause a denial of service...

EulerOS 2.0 SP1 : postgresql (EulerOS-SA-2016-1001)

According to the version of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An integer overflow flaw, leading to a heap-based buffer overflow, was found in the PostgreSQL handling code for regular expressions. A remote...

[SECURITY] Fedora 24 Update: pcre2-10.21-18.fc24

PCRE2 is a re-working of the original PCRE Perl-compatible regular expression library to provide an entirely new API. PCRE2 is written in C, and it has its own API. There are three sets of functions, one for the 8-bit library, which processes strings of bytes, one for the 16-bit library, which...