Date: Fri, 5 Jun 2015 08:55:24 +0800 From: Guanxing Wen <wengx522@...il.com> To: felipensp@...il.com Cc: oss-security@...ts.openwall.com, taviso@...gle.com Subject: Re: Re: Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() Thanks for your explanation. It has also been confirmed from PHP that this is not a bug of their product: " We cannot do much for it. Increase the stack of your server (apache has an option for that for example) or simplify your regex. One should really not feed pcre with custom inputs :) " Cheers, Wen. ----org---- AFAIK this is not a bug on PHP at all, this is a long time known issue on PCRE lib instead. Check the documentation for futher details:http://pcre.org/current/doc/html/pcre2stack.html
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ