CVE-2005-2491 Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code....
HighCVSS 7.5
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pcre | = 5.0 | No fix listed |
| pcre | = 6.0 | No fix listed |
| pcre | = 6.1 | No fix listed |
| debian/gnumeric(Debian:12) | < 1.5.1-1 | 1.5.1-1 |
| debian/gnumeric(Debian:13) | < 1.5.1-1 | 1.5.1-1 |
| debian/gnumeric(Debian:14) | < 1.5.1-1 | 1.5.1-1 |
| debian/goffice(Debian:12) | < 0.1.0-3 | 0.1.0-3 |
| debian/goffice(Debian:13) | < 0.1.0-3 | 0.1.0-3 |
| debian/goffice(Debian:14) | < 0.1.0-3 | 0.1.0-3 |
| debian/pcre3(Debian:12) | < 6.3-1 | 6.3-1 |
References
- APPLE-SA-2005-11-29 vendor-advisory
- SSRT061238 vendor-advisory
- TSLSA-2005-0059 vendor-advisory
- SUSE-SA:2005:051 vendor-advisory
- OpenPKG-SA-2005.018 vendor-advisory
- SSRT090208 vendor-advisory
- 16502 third-party-advisory
- 16679 third-party-advisory
- 17252 third-party-advisory
- 17813 third-party-advisory
- 19072 third-party-advisory
- 19193 third-party-advisory
- 19532 third-party-advisory
- 21522 third-party-advisory
- 22691 third-party-advisory
- 22875 third-party-advisory
- 604 third-party-advisory
- 1014744 patch vdb-entry
- 102198 vendor-advisory
- support.avaya.com
- support.avaya.com
- support.avaya.com
- support.avaya.com
- DSA-800 vendor-advisory
- DSA-817 vendor-advisory
- DSA-819 vendor-advisory
- DSA-821 vendor-advisory
- www.ethereal.com url-repurposed
- GLSA-200508-17 vendor-advisory
- GLSA-200509-02 vendor-advisory
- GLSA-200509-08 vendor-advisory
- GLSA-200509-12 vendor-advisory
- GLSA-200509-19 vendor-advisory
- SUSE-SA:2005:048 vendor-advisory
- SUSE-SA:2005:049 vendor-advisory
- SUSE-SA:2005:052 vendor-advisory
- www.php.net
- RHSA-2005:358 vendor-advisory
- RHSA-2005:761 vendor-advisory
- RHSA-2006:0197 vendor-advisory
- FLSA:168516 vendor-advisory
- SSRT051251 vendor-advisory
- 14620 vdb-entry
- 15647 vdb-entry
- ADV-2005-1511 vdb-entry
- ADV-2005-2659 vdb-entry
- ADV-2006-0789 vdb-entry
- ADV-2006-4320 vdb-entry
- ADV-2006-4502 vdb-entry
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [3/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- oval:org.mitre.oval:def:11516 signature vdb-entry
- oval:org.mitre.oval:def:1496 signature vdb-entry
- oval:org.mitre.oval:def:1659 signature vdb-entry
- oval:org.mitre.oval:def:735 signature vdb-entry
- Debian Security Tracker CVE-2005-2491 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking