oss-security - CVE Request: PCRE Library Heap Overflow Vulnerability

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 6 Aug 2015 00:55:09 +0800
From: Guanxing Wen <wengx522@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request: PCRE Library Heap Overflow Vulnerability

PCRE is a regular expression C library inspired by the regular expression
capabilities in the Perl programming language. The PCRE library is
incorporated into a number of prominent programs, such as Adobe Flash,
Apache, Nginx, PHP.

PCRE library is prone to a vulnerability which leads to Heap Overflow.
During the compilation of a malformed regular expression, more data is
written on the malloced block than the expected size output by
compile_regex. Exploits with advanced Heap Fengshui techniques may allow an
attacker to execute arbitrary code in the context of the user running the
affected application.

Reference:
https://bugs.exim.org/show_bug.cgi?id=1667

Could you assign a CVE-ID for this?

Thank you && Regards.

Wen Guanxing from Venustech ADLAB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.