5.1Mittel
CVE-2019-20454
Beschreibung
An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.
Schwachstellentyp (CWE):
CWE-125
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| fedoraproject | fedora | 31 | |
| pcre | pcre2 | 10.31 – < 10.34 | |
| splunk | universal forwarder | 8.2.0 – < 8.2.12 |
Referenzen und Patches
- https://bugs.exim.org/show_bug.cgi?id=2421 Issue TrackingThird Party Advisory
- https://bugs.php.net/bug.php?id=78338 ExploitIssue TrackingThird Party Advisory
- https://vcs.pcre.org/pcre2?view=revision&revision=1092 Broken LinkPatch
- https://bugzilla.redhat.com/show_bug.cgi?id=1735494 Issue TrackingPatchThird Party Advisory
- GLSA-202006-16 vendor-advisoryThird Party Advisory
- FEDORA-2020-b11cf352bd vendor-advisoryMailing ListThird Party Advisory
- [debian-lts-announce] 20230316 [SECURITY] [DLA 3363-1] pcre2 security update mailing-listMailing ListThird Party Advisory
CPE-Treffer (NVD) (5)
cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*≥ 10.31 < 10.34cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*≥ 8.2.0 < 8.2.12cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.0.6cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*