Description
Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gnumeric | 1.5.1-1 | — |
| Debian 14 | goffice | 0.1.0-3 | — |
| Debian 13 | gnumeric | 1.5.1-1 | — |
| Debian 13 | goffice | 0.1.0-3 | — |
| Debian 12 | gnumeric | 1.5.1-1 | — |
| Debian 12 | goffice | 0.1.0-3 | — |
| Debian 12 | pcre3 | 6.3-1 | — |
| Debian 4.0 | pcre3 | 6.3-0.1etch1 | DTSA-10-1 |
| Debian 3.1 | pcre3 | 4.5-1.2sarge1 | DSA-800-1 |
| Debian 3.1 | python2.1 | 2.1.3dfsg-1sarge1 | DSA-819-1 |
| Debian 3.1 | python2.2 | 2.2.3dfsg-2sarge1 | DSA-817-1 |
| Debian 3.1 | python2.3 | 2.3.5-3sarge1 | DSA-821-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | exim +3 | 4.43-1.RHEL4.5 | RHSA-2005:358 |
| RHEL 4 | pcre +1 | 4.5-3.2.RHEL4 | RHSA-2005:761 |
| RHEL 4 | python +4 | 2.3.4-14.2 | RHSA-2006:0197 |
| RHEL 3 | pcre +1 | 3.9-10.2 | RHSA-2005:761 |
| RHEL 3 | python +3 | 2.2.3-6.2 | RHSA-2006:0197 |
Advisories 8
- RHSA-2006:0197 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:761 Red Hat Security Advisory: pcre security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:358 Red Hat Security Advisory: exim security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-800-1 pcre3 - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-817-1 python2.2 - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-819-1 python2.1 - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-821-1 python2.3 - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-10-1 pcre3 - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- OpenPKG-SA-2005.018 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2005-216.pdf
- 22691 third-party-advisory
- 17813 third-party-advisory
- ADV-2006-4502 vdb-entry
- GLSA-200509-08 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm
- 14620 vdb-entry
- ADV-2005-2659 vdb-entry
- FLSA:168516 vendor-advisory
- GLSA-200509-02 vendor-advisory
- TSLSA-2005-0059 vendor-advisory
- 22875 third-party-advisory
- SSRT061238 vendor-advisory
- SSRT090208 vendor-advisory
- oval:org.mitre.oval:def:1659 vdb-entry signature
- http://www.ethereal.com/appnotes/enpa-sa-00021.html
- SUSE-SA:2005:051 vendor-advisory
- 16502 third-party-advisory
- SSRT051251 vendor-advisory
- 21522 third-party-advisory
- 16679 third-party-advisory
- DSA-817 vendor-advisory
- GLSA-200508-17 vendor-advisory
- ADV-2005-1511 vdb-entry
- 604 third-party-advisory
- 1014744 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2005-223.pdf
- APPLE-SA-2005-11-29 vendor-advisory
- RHSA-2005:761 vendor-advisory
- SUSE-SA:2005:049 vendor-advisory
- DSA-819 vendor-advisory
- ADV-2006-4320 vdb-entry
- RHSA-2005:358 vendor-advisory
- oval:org.mitre.oval:def:1496 vdb-entry signature
- DSA-821 vendor-advisory
- 19072 third-party-advisory
- 19532 third-party-advisory
- http://www.php.net/release_4_4_1.php
- GLSA-200509-19 vendor-advisory
- oval:org.mitre.oval:def:11516 vdb-entry signature
- 17252 third-party-advisory
- GLSA-200509-12 vendor-advisory
- SUSE-SA:2005:052 vendor-advisory
- oval:org.mitre.oval:def:735 vdb-entry signature
- 15647 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-159.htm
- DSA-800 vendor-advisory
- 19193 third-party-advisory
- 102198 vendor-advisory
- SUSE-SA:2005:048 vendor-advisory
- RHSA-2006:0197 vendor-advisory
- ADV-2006-0789 vdb-entry
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [3/13] - /httpd/site/trunk/content/security/json/ mailing-list