Bug 166333

Summary:	CAN-2005-2491 PCRE heap overflow
Product:	[Fedora] Fedora	Reporter:	Mark J. Cox <mjc>
Component:	pcre	Assignee:	Than Ngo <than>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Ben Levenson <benl>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4	CC:	walt
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	5.0-4.1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-08-25 11:09:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	430638

Description Mark J. Cox 2005-08-19 11:47:08 UTC

+++ This bug was initially created as a clone of Bug #166330 +++

PCRE 6.2 was released recently which included a fix for a heap buffer overflow.
 PCRE is used by things such as Apache but only for configuration (therefore
making an exploit low severity).  A number of packages also include PCRE code
internally, I'll be adding separate bugs for those that contain PCRE and do not
use system PCRE later.

Changelog states:

1. There was no test for integer overflow of quantifier values. A construction
such as {1111111111111111} would give undefined results. What is worse, if
a minimum quantifier for a parenthesized subpattern overflowed and became
negative, the calculation of the memory size went wrong. This  could have led to
memory overwriting.

A minimal diff of the flaw is attached, the full 6.2 to 6.1 diff contains other
fixes that might be worth incorporating and a test for this flaw.

FC3 and FC4 affected

Comment 1 Than Ngo 2005-08-19 13:47:30 UTC

it's now fixed in pcre-4.5-3.1.1.fc3 and pcre-5.0-4.1.fc4

Comment 2 Fedora Update System 2005-08-24 15:43:33 UTC

From User-Agent: XML-RPC

pcre-4.5-3.1.1.fc3 has been pushed for FC3, which should resolve this issue.

If these issues are still present in this version, then please re-open this bug.

Comment 3 Fedora Update System 2005-08-24 15:43:37 UTC

From User-Agent: XML-RPC

%(package)s has been pushed for %(release)s, which should resolve this issue.

If these issues are still present in this version, then please re-open this bug.

Comment 4 Walter Justen 2005-08-25 11:09:27 UTC

Thanks for the bug report. This particular bug was fixed and a update package
was published for download. Please feel free to report any further bugs you find.