[Bug 1312782] New: pcre: Heap buffer overflow in pcretest causing infinite loop - mingw - Fedora Mailing-Lists

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

[Bug 1312782] New: pcre: Heap buffer overflow in pcretest causing infinite loop

[Bug 1175542] New: Building NASM...

[Bug 1312794] New: mingw-glib2:...

Red Hat Bugzilla

Monday, 29 February 2016 Mon, 29 Feb '16

3:37 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 Bug ID: 1312782 Summary: pcre: Heap buffer overflow in pcretest causing infinite loop Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: adam.stokes(a)gmail.com, andrew(a)beekhof.net, csutherl(a)redhat.com, databases-maint(a)redhat.com, dknox(a)redhat.com, erik-fedora(a)vanpienbroek.nl, fedora-mingw(a)lists.fedoraproject.org, fidencio(a)redhat.com, jclere(a)redhat.com, jdornak(a)redhat.com, jdoyle(a)redhat.com, jgrulich(a)redhat.com, jorton(a)redhat.com, klember(a)redhat.com, lgao(a)redhat.com, lkundrak(a)v3.sk, marcandre.lureau(a)redhat.com, mbabacek(a)redhat.com, mclasen(a)redhat.com, mmaslano(a)redhat.com, myarboro(a)redhat.com, pmyers(a)valanet.net, ppisar(a)redhat.com, pslavice(a)redhat.com, rcollet(a)redhat.com, rjones(a)redhat.com, rmeggins(a)redhat.com, rsvoboda(a)redhat.com, t.sailer(a)alumni.ethz.ch, twalsh(a)redhat.com, walters(a)redhat.com, webstack-team(a)redhat.com, weli(a)redhat.com Heap-based buffer overread caused by specially crafted input triggering infinite loop in pcretest.c was found affecting pcre 8.38. pcretest went into loop if global matching was requested with an ovector size less than 2. Upstream bug: https://bugs.exim.org/show_bug.cgi?id=1777 Upstream patch: http://vcs.pcre.org/pcre?view=revision&revision=1637 CVE request: http://seclists.org/oss-sec/2016/q1/460 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Show replies by date

Red Hat Bugzilla

Monday, 29 February Mon, 29 Feb

3:38 a.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 --- Comment #1 from Adam Mariš <amaris(a)redhat.com> --- Acknowledgments: Name: Adam Mariš (Red Hat) -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

3:39 a.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 Adam Mariš <amaris(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1312786 Depends On| |1312788 Depends On| |1312789 Depends On| |1312791 Depends On| |1312793 Depends On| |1312794 --- Comment #2 from Adam Mariš <amaris(a)redhat.com> --- Created pcre tracking bugs for this issue: Affects: fedora-all [bug 1312786] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1312786 [Bug 1312786] pcre: Heap buffer overflow in pcretest causing infinite loop [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1312788 [Bug 1312788] mingw-pcre: pcre: Heap buffer overflow in pcretest causing infinite loop [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1312789 [Bug 1312789] glib2: pcre: Heap buffer overflow in pcretest causing infinite loop [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1312791 [Bug 1312791] mingw-glib2: pcre: Heap buffer overflow in pcretest causing infinite loop [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1312793 [Bug 1312793] mingw-pcre: pcre: Heap buffer overflow in pcretest causing infinite loop [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1312794 [Bug 1312794] mingw-glib2: pcre: Heap buffer overflow in pcretest causing infinite loop [epel-7] -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

3:39 a.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 --- Comment #3 from Adam Mariš <amaris(a)redhat.com> --- Created glib2 tracking bugs for this issue: Affects: fedora-all [bug 1312789] -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

3:40 a.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 --- Comment #4 from Adam Mariš <amaris(a)redhat.com> --- Created mingw-glib2 tracking bugs for this issue: Affects: fedora-all [bug 1312791] Affects: epel-7 [bug 1312794] -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

3:40 a.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 --- Comment #5 from Adam Mariš <amaris(a)redhat.com> --- Created mingw-pcre tracking bugs for this issue: Affects: fedora-all [bug 1312788] Affects: epel-7 [bug 1312793] -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

3:41 a.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 Adam Mariš <amaris(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1312802 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

2:54 p.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 --- Comment #6 from Tomas Hoger <thoger(a)redhat.com> --- Minimal reproducer is: //G \O1 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

Tuesday, 1 March Tue, 1 Mar

7:50 p.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 --- Comment #7 from Fedora Update System <updates(a)fedoraproject.org> --- pcre-8.38-6.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

7:50 p.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 Bug 1312782 depends on bug 1312786, which changed state. Bug 1312786 Summary: pcre: Heap buffer overflow in pcretest causing infinite loop [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1312786 What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

Tuesday, 15 March Tue, 15 Mar

8:50 p.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 --- Comment #8 from Fedora Update System <updates(a)fedoraproject.org> --- pcre-8.38-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

Thursday, 17 March Thu, 17 Mar

9:06 a.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop (8.39/15)

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 Tomas Hoger <thoger(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |unspecified Status|NEW |CLOSED Fixed In Version| |pcre 8.39 Resolution|--- |NOTABUG Summary|pcre: Heap buffer overflow |pcre: Heap buffer overflow |in pcretest causing |in pcretest causing |infinite loop |infinite loop (8.39/15) Whiteboard|impact=moderate,public=2016 |impact=none,public=20160114 |0114,reported=20160114,sour |,reported=20160114,source=r |ce=redhat,cvss2=4.3/AV:N/AC |edhat,cwe=CWE-122,rhel-5/pc |:M/Au:N/C:N/I:N/A:P,cwe=CWE |re=new,rhel-6/pcre=new,rhel |-122,rhel-5/pcre=new,rhel-6 |-7/pcre=new,rhel-6/glib2=ne |/pcre=new,rhel-7/pcre=new,r |w,rhel-7/glib2=new,rhel-7/v |hel-6/glib2=new,rhel-7/glib |irtuoso-opensource=new,rhsc |2=new,rhel-7/virtuoso-opens |l-2/php54-php=new,rhscl-2/p |ource=new,rhscl-2/php54-php |hp55-php=new,rhscl-2/rh-php |=new,rhscl-2/php55-php=new, |56-php=new,rhscl-2/rh-maria |rhscl-2/rh-php56-php=new,rh |db100-mariadb=new,rhscl-2/r |scl-2/rh-mariadb100-mariadb |h-mariadb101-mariadb=new,jb |=new,rhscl-2/rh-mariadb101- |ews-1/httpd=new,jbews-2/htt |mariadb=new,jbews-1/httpd=n |pd=new,jbews-3/pcre=new,dir |ew,jbews-2/httpd=new,jbews- |ectory_server_8/pcre=new,fe |3/pcre=new,directory_server |dora-all/pcre=affected,fedo |_8/pcre=new,fedora-all/pcre |ra-all/mingw-pcre=affected, |=affected,fedora-all/mingw- |fedora-all/glib2=affected,f |pcre=affected,fedora-all/gl |edora-all/mingw-glib2=affec |ib2=affected,fedora-all/min |ted,epel-7/mingw-pcre=affec |gw-glib2=affected,epel-7/mi |ted,epel-7/mingw-glib2=affe |ngw-pcre=affected,epel-7/mi |cted |ngw-glib2=affected | Severity|medium |unspecified Last Closed| |2016-03-17 10:06:19 --- Comment #9 from Tomas Hoger <thoger(a)redhat.com> --- This is similar to bug 1285413 comment 7 and not relevant / security for the same reasons - pcretest is an application used for testing the pcre library. It offers ways to use the library in ways that are incorrect with respect to the documented API. Additionally, as this flaw is in the pcretest application, components that embed the pcre library while not using pcretest (e.g. glib2 mentioned above) could not have been affected. Upstream version 8.13 is the first where infinite loop is triggered, valgrind reports "Conditional jump or move depends on uninitialised value(s)" error in earlier versions. -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

1:27 p.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop (8.39/15)

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 Tomas Hoger <thoger(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=none,public=20160114 |impact=none,public=20160114 |,reported=20160114,source=r |,reported=20160114,source=r |edhat,cwe=CWE-122,rhel-5/pc |edhat,cwe=CWE-122,rhel-5/pc |re=new,rhel-6/pcre=new,rhel |re=affected,rhel-6/pcre=aff |-7/pcre=new,rhel-6/glib2=ne |ected,rhel-7/pcre=affected, |w,rhel-7/glib2=new,rhel-7/v |rhel-6/glib2=notaffected,rh |irtuoso-opensource=new,rhsc |el-7/glib2=notaffected,rhel |l-2/php54-php=new,rhscl-2/p |-7/virtuoso-opensource=nota |hp55-php=new,rhscl-2/rh-php |ffected,rhscl-2/php54-php=n |56-php=new,rhscl-2/rh-maria |otaffected,rhscl-2/php55-ph |db100-mariadb=new,rhscl-2/r |p=notaffected,rhscl-2/rh-ph |h-mariadb101-mariadb=new,jb |p56-php=notaffected,rhscl-2 |ews-1/httpd=new,jbews-2/htt |/rh-mariadb100-mariadb=nota |pd=new,jbews-3/pcre=new,dir |ffected,rhscl-2/rh-mariadb1 |ectory_server_8/pcre=new,fe |01-mariadb=notaffected,jbew |dora-all/pcre=affected,fedo |s-1/httpd=notaffected,jbews |ra-all/mingw-pcre=affected, |-2/httpd=notaffected,jbews- |fedora-all/glib2=affected,f |3/pcre=affected,directory_s |edora-all/mingw-glib2=affec |erver_8/pcre=notaffected,fe |ted,epel-7/mingw-pcre=affec |dora-all/pcre=affected,fedo |ted,epel-7/mingw-glib2=affe |ra-all/mingw-pcre=affected, |cted |epel-7/mingw-pcre=affected, | |fedora-all/glib2=notaffecte | |d,fedora-all/mingw-glib2=no | |taffected,epel-7/mingw-glib | |2=notaffected -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

1:28 p.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop (8.39/15)

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 Bug 1312782 depends on bug 1312789, which changed state. Bug 1312789 Summary: glib2: pcre: Heap buffer overflow in pcretest causing infinite loop [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1312789 What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

1:28 p.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop (8.39/15)

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 Bug 1312782 depends on bug 1312791, which changed state. Bug 1312791 Summary: mingw-glib2: pcre: Heap buffer overflow in pcretest causing infinite loop [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1312791 What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

1:29 p.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop (8.39/15)

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 Bug 1312782 depends on bug 1312794, which changed state. Bug 1312794 Summary: mingw-glib2: pcre: Heap buffer overflow in pcretest causing infinite loop [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1312794 What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

1:31 p.m.

New subject: [Bug 1312782] pcre: Heap buffer overflow in pcretest causing infinite loop (8.39/15)

https://bugzilla.redhat.com/show_bug.cgi?id=1312782 Tomas Hoger <thoger(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1295388 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

2978

days inactive

2995

days old

mingw@lists.fedoraproject.org

Manage subscription

16 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla