Bug 1320995 (CVE-2014-9769)
| Summary: | CVE-2014-9769 pcre: incorrect nested table jumps when JIT is used (8.36/6) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | adam.stokes, andrew, anemec, athmanem, carnil, csutherl, databases-maint, dknox, erik-fedora, fedora-mingw, fedora, fidencio, jclere, jdornak, jdoyle, jgrulich, jmlich83, jorton, jtfas90, klember, lgao, lkundrak, marcandre.lureau, mbabacek, mclasen, mmaslano, myarboro, pmyers, ppisar, pslavice, rcollet, rjones, rmeggins, rsvoboda, sardella, sgrubb, slawomir, twalsh, walters, webstack-team, weli |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | pcre 8.36 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-04-01 12:05:44 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1320996, 1320997, 1320998, 1320999, 1321000, 1321001, 1321002 | ||
| Bug Blocks: | 1285420, 1321003 | ||
|
Description
Adam Mariš
2016-03-24 12:54:49 UTC
Created pcre tracking bugs for this issue: Affects: fedora-all [bug 1320996] Created suricata tracking bugs for this issue: Affects: fedora-all [bug 1321002] Created glib2 tracking bugs for this issue: Affects: fedora-all [bug 1320998] Created mingw-glib2 tracking bugs for this issue: Affects: fedora-all [bug 1320999] Affects: epel-7 [bug 1321001] Created mingw-pcre tracking bugs for this issue: Affects: fedora-all [bug 1320997] Affects: epel-7 [bug 1321000] Could you please provide reproducer? The debian bug report <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819050> is missing the "file" file content. Moreover, the reporter claimed it happens with pcre-8.35 but not with 8.38. We have 8.38 in all supported Fedoras. CVE assignment: http://seclists.org/oss-sec/2016/q1/704 This was fixes with upstream commit:
commit 60f995fc2f823183783633d5eb8af2eceb0bb663
Author: zherczeg <zherczeg@2f5784b3-3f2a-0410-8824-cb99058d5e15>
Date: Fri Apr 25 11:59:19 2014 +0000
Fixed an issue with nested table jumps.
git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1475 2f5784b3-3f2a-0410-8824-cb99058d5e15
and fixed in subsequent pcre-8.36 release.
Reproducer from the commit:
$ printf '%s\n%s\n' '/(?:x|(?:(xx|yy)+|x|x|x|x|x)|a|a|a)bc/' 'acb' | ./pcretest -s++
PCRE version 8.35 2014-04-04
re> Segmentation fault (core dumped)
The following post indicates that this issue was introduced in pcre version 8.35 via the following commit: http://vcs.pcre.org/pcre?view=revision&revision=1434 and corrected in 8.36 using the following commit (the same one as pointed out in comment 8 above): http://vcs.pcre.org/pcre?view=revision&revision=1475 Only upstream version 8.35 was affected by this issue. Red Hat products do not currently contain any package that includes pcre version 8.35. |