CVE-2008-2371

2008-07-0700:00:00

ubuntu.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.1%

JSON

Heap-based buffer overflow in pcre_compile.c in the Perl-Compatible Regular
Expression (PCRE) library 7.7 allows context-dependent attackers to cause a
denial of service (crash) or possibly execute arbitrary code via a regular
expression that begins with an option and contains multiple branches.

Bugs

<https://bugs.edge.launchpad.net/ubuntu/+source/erlang/+bug/535090>

Notes

Author	Note
jdstrand	kees did pcre3 update php5 on dapper and feisty is not vulnerable jdstrand sponsored erlang update for karmic and lucid

OSVersionArchitecturePackageVersionFilename
ubuntu8.10noarcherlang< 1:12.b.3-dfsg-1ubuntu1.1UNKNOWN
ubuntu9.04noarcherlang< 1:12.b.5-dfsg-2ubuntu0.1UNKNOWN
ubuntu9.10noarcherlang< 1:13.b.1-dfsg-2ubuntu1.1UNKNOWN
ubuntu6.06noarchpcre3< 7.4-0ubuntu0.6.06.3UNKNOWN
ubuntu7.04noarchpcre3< 7.4-0ubuntu0.7.04.3UNKNOWN
ubuntu7.10noarchpcre3< 7.4-0ubuntu0.7.10.3UNKNOWN
ubuntu8.04noarchpcre3< 7.4-1ubuntu2.1UNKNOWN
ubuntu8.10noarchpcre3< 7.6-2.1ubuntu1UNKNOWN
ubuntu7.10noarchphp5< 5.2.3-1ubuntu6.4UNKNOWN
ubuntu8.04noarchphp5< 5.2.4-2ubuntu5.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.10	noarch	erlang	< 1:12.b.3-dfsg-1ubuntu1.1	UNKNOWN
ubuntu	9.04	noarch	erlang	< 1:12.b.5-dfsg-2ubuntu0.1	UNKNOWN
ubuntu	9.10	noarch	erlang	< 1:13.b.1-dfsg-2ubuntu1.1	UNKNOWN
ubuntu	6.06	noarch	pcre3	< 7.4-0ubuntu0.6.06.3	UNKNOWN
ubuntu	7.04	noarch	pcre3	< 7.4-0ubuntu0.7.04.3	UNKNOWN
ubuntu	7.10	noarch	pcre3	< 7.4-0ubuntu0.7.10.3	UNKNOWN
ubuntu	8.04	noarch	pcre3	< 7.4-1ubuntu2.1	UNKNOWN
ubuntu	8.10	noarch	pcre3	< 7.6-2.1ubuntu1	UNKNOWN
ubuntu	7.10	noarch	php5	< 5.2.3-1ubuntu6.4	UNKNOWN
ubuntu	8.04	noarch	php5	< 5.2.4-2ubuntu5.3	UNKNOWN