Quoting http://www.openwall.com/lists/oss-security/2015/06/26/1: """ PCRE is a regular expression C library inspired by the regular expression capabilities in the Perl programming language. The PCRE library is incorporated into a number of prominent programs, such as Adobe Flash, Apache, Nginx, PHP. PCRE library is prone to a vulnerability which leads to Heap Overflow. During subpattern calculation of a malformed regular expression, an offset that is used as an array index is fully controlled and can be large enough so that unexpected heap memory regions are accessed. One could at least exploit this issue to read objects nearby of the affected application's memory. Such information discloure may also be used to bypass memory protection method such as ASLR. Reference: https://bugs.exim.org/show_bug.cgi?id=1651 """ The patch is available in the upstream bug: https://bugs.exim.org/show_bug.cgi?id=1651
Created pcre tracking bugs for this issue: Affects: fedora-all [bug 1237224]
Created mingw-pcre tracking bugs for this issue: Affects: fedora-all [bug 1237225]
Upstream fixed it with: commit 764692f9aea9eab50fdba6cb537441d8b34c6c37 Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15> Date: Tue Jun 23 16:34:53 2015 +0000 Fix buffer overflow for forward reference within backward assertion with excess closing parenthesis. Bugzilla 1651. git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1571 2f5784b3-3f2a-0410-8824-cb99058d5e15
pcre-8.37-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
pcre-8.35-12.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
Upstream commit: http://vcs.pcre.org/pcre?view=revision&revision=1571 Fixed upstream in version 8.38.
Introduced in pcre 8.00: http://vcs.pcre.org/pcre?view=revision&revision=454
*** Bug 1287654 has been marked as a duplicate of this bug. ***
Adding duplicate CVE.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:1025 https://rhn.redhat.com/errata/RHSA-2016-1025.html
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Via RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html