| Vulnerability Name: | CVE-2006-7227 (CCN-38426) | ||||||||||||||||||||||||||||||||
| Assigned: | 2007-11-07 | ||||||||||||||||||||||||||||||||
| Published: | 2007-11-07 | ||||||||||||||||||||||||||||||||
| Updated: | 2023-02-13 | ||||||||||||||||||||||||||||||||
| Summary: | Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (name_count) or long subpattern names (max_name_size), which triggers a buffer overflow. Note: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split. | ||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P) 5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-190 | ||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||||||
| References: | Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: MITRE Type: CNA CVE-2006-7227 Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: CCN Type: gnome-announce-list, Wed, 07 Nov 2007 01:51:19 -0500 GLib 2.14.3 Source: CCN Type: RHSA-2007-1052 Critical: pcre security update Source: CCN Type: CESA-2007-006 - rev 1 pcre integer / buffer overflows Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: CCN Type: SA27582 PCRE Regex Parsing Multiple Vulnerabilities Source: CCN Type: SA27869 Avaya Products PCRE Regex Parsing Multiple Vulnerabilities Source: CCN Type: SA28414 R PCRE Multiple Vulnerabilities Source: CCN Type: SA30155 Chicken PCRE Buffer Overflow Vulnerability Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: CCN Type: SECTRACK ID: 1018930 PCRE Regex Processing Integer Overflows May Let Users Execute Arbitrary Code Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: CCN Type: ASA-2007-493 pcre security update (RHSA-2007-1052) Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: DEBIAN Type: DSA-1570 kazehakase -- various Source: CCN Type: GLSA-200711-30 PCRE: Multiple vulnerabilities Source: CCN Type: GLSA-200801-02 R: Multiple vulnerabilities Source: CCN Type: GLSA-200801-18 Kazehakase: Multiple vulnerabilities Source: CCN Type: GLSA-200801-19 GOffice: Multiple vulnerabilities Source: CCN Type: GLSA-200805-11 Chicken: Multiple vulnerabilities Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: CCN Type: PCRE Web site PCRE - Perl Compatible Regular Expressions Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: secalert@redhat.com Type: Patch secalert@redhat.com Source: CCN Type: BID-26462 PCRE Regular Expression Library Multiple Integer and Buffer Overflow Vulnerabilities Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: XF Type: UNKNOWN pcre-regex-multiple-overflow(38426) Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: SUSE Type: SUSE-SA:2007:062 pcre security problems Source: SUSE Type: SUSE-SA:2008:004 php5 php4 Security Problems | ||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration RedHat 1: Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||