Description
Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via regex patterns containing unmatched "\Q\E" sequences with orphan "\E" codes.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glib2.0 | 2.14.3-1 | — |
| Debian 13 | glib2.0 | 2.14.3-1 | — |
| Debian 12 | glib2.0 | 2.14.3-1 | — |
| Debian 12 | pcre3 | 7.3-1 | — |
| Debian 5.0 | pcre3 | 6.7+7.4-2+lenny1 | DTSA-77-1 |
| Debian 4.0 | kazehakase | 0.4.2-1etch1 | DSA-1570-1 |
| Debian 4.0 | pcre3 | 6.7+7.4-2 | DSA-1399-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | pcre3 | 4.5+7.4-1 | DSA-1399-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | pcre +1 | 6.6-2.el5_0.1 | RHSA-2007:0967 |
| RHEL 4 | pcre +1 | 4.5-4.el4_6.6 | RHSA-2007:1068 |
Advisories 5
- RHSA-2007:0967 Red Hat Security Advisory: pcre security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1068 Red Hat Security Advisory: pcre security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1570-1 kazehakase - execution of arbitrary code Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-77-1 pcre3 - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1399-1 pcre3 - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 30219 third-party-advisory
- MDKSA-2007:212 vendor-advisory
- 27965 third-party-advisory
- 29267 third-party-advisory
- USN-547-1 vendor-advisory
- GLSA-200711-30 vendor-advisory
- ADV-2007-4238 vdb-entry
- 20071106 rPSA-2007-0231-1 pcre mailing-list
- TA07-352A third-party-advisory
- 27538 third-party-advisory
- 20071112 FLEA-2007-0064-1 pcre mailing-list
- 28136 third-party-advisory
- MDVSA-2008:030 vendor-advisory
- DSA-1570 vendor-advisory
- SUSE-SA:2008:004 vendor-advisory
- https://issues.rpath.com/browse/RPL-1738
- 28658 third-party-advisory
- 27773 third-party-advisory
- 27697 third-party-advisory
- 28406 third-party-advisory
- 27554 third-party-advisory
- ADV-2008-0924 vdb-entry
- SUSE-SR:2007:025 vendor-advisory
- 27547 third-party-advisory
- 27543 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-505.htm
- [gtk-devel-list] 20071107 GLib 2.14.3 mailing-list
- 29420 third-party-advisory
- APPLE-SA-2007-12-17 vendor-advisory
- pcre-regex-code-execution(38272) vdb-entry
- RHSA-2007:1068 vendor-advisory
- GLSA-200805-11 vendor-advisory
- APPLE-SA-2008-03-18 vendor-advisory
- MDKSA-2007:211 vendor-advisory
- FEDORA-2008-1842 vendor-advisory
- 28041 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=307179
- 27741 third-party-advisory
- ADV-2007-3790 vdb-entry
- 1018895 vdb-entry
- ADV-2007-3725 vdb-entry
- SUSE-SA:2007:062 vendor-advisory
- http://www.pcre.org/changelog.txt
- http://docs.info.apple.com/article.html?artnum=307562
- 30155 third-party-advisory
- RHSA-2007:0967 vendor-advisory
- 28720 third-party-advisory
- GLSA-200801-02 vendor-advisory
- oval:org.mitre.oval:def:9725 vdb-entry signature
- 27598 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=198976
- GLSA-200801-19 vendor-advisory
- GLSA-200801-18 vendor-advisory
- DSA-1399 vendor-advisory
- 28414 third-party-advisory
- 26346 vdb-entry
- 30106 third-party-advisory
- 28714 third-party-advisory