pcre -- heap overflow vulnerability in '(?|' situations

Venustech ADLAB reports: PCRE library is prone to a vulnerability which leads to Heap Overflow. During the compilation of a malformed regular expression, more data is written on the malloced block than the expected size output by compileregex. Exploits with advanced Heap Fengshui techniques may...

Scientific Linux Security Update : grep on SL6.x i386/x86_64 (20150722)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way grep parsed large lines of data. An attacker able to trick a user into running grep on a specially crafted data file could use this flaw to crash grep or, potentially, execute arbitrary code with the privilege...

[USN-2694-1] PCRE vulnerabilities

========================================================================== Ubuntu Security Notice USN-2694-1 July 29, 2015 pcre3 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...

USN-2694-1: PCRE vulnerabilities

Michele Spagnuolo discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. CVE-2014-8964...

MGASA-2015-0293 Updated python-django and python-django14 packages fix security vulnerabilities

Eric Peterson and Lin Hua Cheng discovered that a new empty record used to be created in the session storage every time a session was accessed and an unknown session key was provided in the request cookie. This could allow remote attackers to saturate the session store or cause other users' sessi...

CVE-2015-5605

The regular-expression implementation in Google V8, as used in Google Chrome before 44.0.2403.89, mishandles interrupts, which allows remote attackers to cause a denial of service application crash via crafted JavaScript code, as demonstrated by an error in garbage collection during allocation of...

RedHat Update for grep RHSA-2015:1447-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-5605

CVE-2015-5605 affects Google Chrome/Chromium with the V8 JavaScript engine. The vulnerability lies in the regular-expression implementation, which mishandles interrupts during stack-overflow exception message allocation, enabling a remote attacker to cause a denial of service (application crash) ...

Fedora 21 : pcre-8.35-12.fc21 (2015-11019)

This release fixes two heap buffer overflows when compiling certain regular expressions: CVE-2015-3210 and CVE-2015-5073. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

[SECURITY] Fedora 21 Update: pcre-8.35-12.fc21

Perl-compatible regular expression library. PCRE has its own native API, but a set of "wrapper" functions that are base d on the POSIX API are also supplied in the library libpcreposix. Note that this just provides a POSIX calling interface to PCRE: the regular expressions themselves still follow...

CVE-2015-5144

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an 1 email message to the EmailValidator, a ...

CVE-2015-5144

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an 1 email message to the EmailValidator, a ...

DOS via URL validation

django.core.validators.URLValidator includes a regular expression that was extremely slow to evaluate against certain inputs...

[SECURITY] Fedora 22 Update: pcre-8.37-2.fc22

Perl-compatible regular expression library. PCRE has its own native API, but a set of "wrapper" functions that are base d on the POSIX API are also supplied in the library libpcreposix. Note that this just provides a POSIX calling interface to PCRE: the regular expressions themselves still follow...

PCRE 'find_fixedlength()' function heap buffer overflow vulnerability

PCRE is a software developer Philip Hazel developed by the use of C language written in open source regular expression library . PCRE suffers from a heap buffer overflow vulnerability that could be exploited by an attacker to crash an affected application or execute arbitrary code...

CVE-2015-5073

Heap-based buffer overflow in the findfixedlength function in pcrecompile.c in PCRE before 8.38 allows remote attackers to cause a denial of service crash or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an...

PCRE 'pcre_compile2()' function heap buffer overflow vulnerability

PCRE Perl Compatible Regular Expressions is a software developer Philip Hazel developed a use of C language written in open source regular expression library. PCRE suffers from a heap buffer overflow vulnerability in 'pcrecompile2'. An attacker is allowed to exploit this vulnerability to execute...

pcre -- Heap Overflow Vulnerability in find_fixedlength()

Venustech ADLAB reports: PCRE library is prone to a vulnerability which leads to Heap Overflow. During subpattern calculation of a malformed regular expression, an offset that is used as an array index is fully controlled and can be large enough so that unexpected heap memory regions are accessed...

SUSE-SU-2015:1144-1 Security update for icu

This update fixes the following security issue in icu: CVE-2014-9654: insufficient size limit checks in regular expression compiler bsc917129 Security Issues: CVE-2014-9654...

PCRE 'match()' function stack buffer overflow vulnerability

PCRE Perl Compatible Regular Expressions is a software developer Philip Hazel developed a use of C language written in open source regular expression library. A stack buffer overflow vulnerability exists in the PCRE 'match' function. An attacker could exploit this vulnerability to execute arbitra...