Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 5 Jun 2015 08:55:24 +0800
From: Guanxing Wen <wengx522@...il.com>
To: felipensp@...il.com
Cc: oss-security@...ts.openwall.com, taviso@...gle.com
Subject: Re: Re: Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack
 Overflow Vulnerability in match()

Thanks for your explanation.
 It has also been confirmed from PHP that this is not a bug of their
product:

"
We cannot do much for it.
Increase the stack of your server (apache has an option for that for
example) or simplify your regex.
One should really not feed pcre with custom inputs :)
"

Cheers, Wen.
----org----

AFAIK this is not a bug on PHP at all, this is a long time known issue
on PCRE lib instead.
Check the documentation for futher
details:http://pcre.org/current/doc/html/pcre2stack.html

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ