+++ This bug was initially created as a clone of Bug #166330 +++ PCRE 6.2 was released recently which included a fix for a heap buffer overflow. PCRE is used by things such as Apache but only for configuration (therefore making an exploit low severity). A number of packages also include PCRE code internally, I'll be adding separate bugs for those that contain PCRE and do not use system PCRE later. Changelog states: 1. There was no test for integer overflow of quantifier values. A construction such as {1111111111111111} would give undefined results. What is worse, if a minimum quantifier for a parenthesized subpattern overflowed and became negative, the calculation of the memory size went wrong. This could have led to memory overwriting. A minimal diff of the flaw is attached, the full 6.2 to 6.1 diff contains other fixes that might be worth incorporating and a test for this flaw. FC3 and FC4 affected
it's now fixed in pcre-4.5-3.1.1.fc3 and pcre-5.0-4.1.fc4
From User-Agent: XML-RPC pcre-4.5-3.1.1.fc3 has been pushed for FC3, which should resolve this issue. If these issues are still present in this version, then please re-open this bug.
From User-Agent: XML-RPC %(package)s has been pushed for %(release)s, which should resolve this issue. If these issues are still present in this version, then please re-open this bug.
Thanks for the bug report. This particular bug was fixed and a update package was published for download. Please feel free to report any further bugs you find.