Tavis Ormandy of the Google Security Team reported multiple pcre regular expressions flaws. Here are the details pasted from Tavis' mail: CVE-2007-1660: multiple forms of character class had their sizes miscalculated on initial passes, resulting in too little memory being allocated, this was also inadvertently fixed in version 7.0, where the compile phase was entirely re-engineered (and much improved, from a security standpoint). Acknowledgements: Red Hat would like to thank Tavis Ormandy and Will Drewry for properly disclosing these issues.
Lifting embargo
Created attachment 259991 [details] Patch backported to pcre-3.9 in EL3
Created attachment 261501 [details] Patch backported to pcre-3.4 in EL2.1
This issue was addressed in: Red Hat Enterprise Linux: http://rhn.redhat.com/errata/RHSA-2007-0967.html http://rhn.redhat.com/errata/RHSA-2007-0968.html http://rhn.redhat.com/errata/RHSA-2007-1063.html http://rhn.redhat.com/errata/RHSA-2007-1065.html