Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 24 Nov 2015 11:33:43 +0100
From: Hanno Böck <>
Subject: Heap Overflow in PCRE

The Perl Compatible Regular Expressions (PCRE) library has just
released a new version which fixes a number of security issues.

Fuzzing the pcretest tool uncovered an input leading to a heap overflow
in the function pcre_exec. This bug was found with the help of american
fuzzy lop and address sanitizer. Upstream bug #1637 (PoC and
ASAN trace attached there)

This is fixed in PCRE 8.38. There are two variants of PCRE, the classic
one and PCRE2. PCRE2 is not affected.

Appart from that a couple of other vulnerabilities found by other
people have been fixed in this release:
Heap overflow in compile_regex
Stack overflow in compile_regex
Heap overflow in compile_regex

If you use PCRE to parse untrusted inputs you should update immediately.

Hanno Böck


Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.