National Cyber-Alert System

Vulnerability Summary for CVE-2005-2491

Overview

Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Apache (07/02/2008)

Fixed in Apache 2.0.55: http://httpd.apache.org/security/vulnerabilities_20.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: SECTRACK

Name: 1014744

Type: Patch Information

Hyperlink:http://securitytracker.com/id?1014744

External Source: BID

Name: 14620

Hyperlink:http://www.securityfocus.com/bid/14620

External Source: HP

Name: HPSBUX02074

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/428138/100/0/threaded

External Source: BID

Name: 15647

Hyperlink:http://www.securityfocus.com/bid/15647

External Source: HP

Name: HPSBUX02074

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/428138/100/0/threaded

External Source: FEDORA

Name: FLSA:168516

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/427046/100/0/threaded

External Source: REDHAT

Name: RHSA-2006:0197

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0197.html

External Source: REDHAT

Name: RHSA-2005:761

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-761.html

External Source: REDHAT

Name: RHSA-2005:358

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-358.html

External Source: CONFIRM

Name: http://www.php.net/release_4_4_1.php

Hyperlink:http://www.php.net/release_4_4_1.php

External Source: SUSE

Name: SUSE-SA:2005:052

Hyperlink:http://www.novell.com/linux/security/advisories/2005_52_apache2.html

External Source: SUSE

Name: SUSE-SA:2005:049

Hyperlink:http://www.novell.com/linux/security/advisories/2005_49_php.html

External Source: SUSE

Name: SUSE-SA:2005:048

Hyperlink:http://www.novell.com/linux/security/advisories/2005_48_pcre.html

External Source: GENTOO

Name: GLSA-200509-19

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml

External Source: GENTOO

Name: GLSA-200509-12

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200509-12.xml

External Source: GENTOO

Name: GLSA-200509-02

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200509-02.xml

External Source: GENTOO

Name: GLSA-200509-08

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200508-17.xml

External Source: VUPEN

Name: ADV-2006-4502

Hyperlink:http://www.frsirt.com/english/advisories/2006/4502

External Source: VUPEN

Name: ADV-2006-4320

Hyperlink:http://www.frsirt.com/english/advisories/2006/4320

External Source: VUPEN

Name: ADV-2006-0789

Hyperlink:http://www.frsirt.com/english/advisories/2006/0789

External Source: VUPEN

Name: ADV-2005-2659

Hyperlink:http://www.frsirt.com/english/advisories/2005/2659

External Source: VUPEN

Name: ADV-2005-1511

Hyperlink:http://www.frsirt.com/english/advisories/2005/1511

External Source: CONFIRM

Name: http://www.ethereal.com/appnotes/enpa-sa-00021.html

Hyperlink:http://www.ethereal.com/appnotes/enpa-sa-00021.html

External Source: DEBIAN

Name: DSA-821

Hyperlink:http://www.debian.org/security/2005/dsa-821

External Source: DEBIAN

Name: DSA-819

Hyperlink:http://www.debian.org/security/2005/dsa-819

External Source: DEBIAN

Name: DSA-817

Hyperlink:http://www.debian.org/security/2005/dsa-817

External Source: DEBIAN

Name: DSA-800

Hyperlink:http://www.debian.org/security/2005/dsa-800

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-159.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-159.htm

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2005-223.pdf

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2005-223.pdf

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2005-216.pdf

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2005-216.pdf

External Source: SUNALERT

Name: 102198

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1

External Source: SREASON

Name: 604

Hyperlink:http://securityreason.com/securityalert/604

External Source: SECUNIA

Name: 22875

Hyperlink:http://secunia.com/advisories/22875

External Source: SECUNIA

Name: 22691

Hyperlink:http://secunia.com/advisories/22691

External Source: SECUNIA

Name: 21522

Hyperlink:http://secunia.com/advisories/21522

External Source: SECUNIA

Name: 19532

Hyperlink:http://secunia.com/advisories/19532

External Source: SECUNIA

Name: 19193

Hyperlink:http://secunia.com/advisories/19193

External Source: SECUNIA

Name: 19072

Hyperlink:http://secunia.com/advisories/19072

External Source: SECUNIA

Name: 17813

Hyperlink:http://secunia.com/advisories/17813

External Source: SECUNIA

Name: 17252

Hyperlink:http://secunia.com/advisories/17252

External Source: SECUNIA

Name: 16679

Hyperlink:http://secunia.com/advisories/16679

External Source: SECUNIA

Name: 16502

Hyperlink:http://secunia.com/advisories/16502

External Source: OPENPKG

Name: OpenPKG-SA-2005.018

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=112606064317223&w=2

External Source: SUSE

Name: SUSE-SA:2005:051

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=112605112027335&w=2

External Source: TRUSTIX

Name: TSLSA-2005-0059

Hyperlink:http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html

External Source: HP

Name: SSRT061238

Hyperlink:http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522

External Source: APPLE

Name: APPLE-SA-2005-11-29

Hyperlink:http://docs.info.apple.com/article.html?artnum=302847

External Source: SGI

Name: 20060401-01-U

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U

External Source: SCO

Name: SCOSA-2006.10

Hyperlink:ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.10/SCOSA-2006.10.txt

US Government Resource: oval:org.mitre.oval:def:735

Name: oval:org.mitre.oval:def:735

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:735

US Government Resource: oval:org.mitre.oval:def:1659

Name: oval:org.mitre.oval:def:1659

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1659

US Government Resource: oval:org.mitre.oval:def:1496

Name: oval:org.mitre.oval:def:1496

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1496