Description
Buffer overflow in PCRE before 7.6 allows remote attackers to execute arbitrary code via a regular expression containing a character class with a large number of characters with Unicode code points greater than 255.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | pcre3 | 7.6-1 | — |
| Debian 5.0 | pcre3 | 7.4-1+lenny1 | DTSA-115-1 |
| Debian 4.0 | pcre3 | 6.7+7.4-3 | DSA-1499-1 |
| Debian 3.1 | pcre3 | 4.5+7.4-2 | DSA-1499-1 |
Advisories 2
- DSA-1499-1 pcre3 - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-115-1 pcre3 - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 29267 third-party-advisory
- ADV-2008-1412 vdb-entry
- http://support.apple.com/kb/HT3757
- 20080523 rPSA-2008-0176-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl mailing-list
- FEDORA-2008-1533 vendor-advisory
- 28923 third-party-advisory
- 32746 third-party-advisory
- 29048 third-party-advisory
- GLSA-200803-24 vendor-advisory
- DSA-1499 vendor-advisory
- APPLE-SA-2008-07-31 vendor-advisory
- GLSA-200811-05 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=431660
- http://ftp.gnome.org/pub/gnome/sources/glib/2.14/glib-2.14.6.news
- 28957 third-party-advisory
- 31681 vdb-entry
- 36096 third-party-advisory
- 29009 vdb-entry
- 29027 third-party-advisory
- 29282 third-party-advisory
- ADV-2008-2268 vdb-entry
- 28960 third-party-advisory
- 30345 third-party-advisory
- 20080228 rPSA-2008-0086-1 pcre mailing-list
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0176
- [oss-security] 20080502 CVE Request (PHP) mailing-list
- 28996 third-party-advisory
- APPLE-SA-2009-08-05-1 vendor-advisory
- http://www.php.net/ChangeLog-5.php
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0086
- MDVSA-2008:053 vendor-advisory
- SUSE-SR:2008:004 vendor-advisory
- 32222 third-party-advisory
- FEDORA-2008-1842 vendor-advisory
- ADV-2008-0592 vdb-entry
- pcre-characterclass-bo(40505) vdb-entry
- 29175 third-party-advisory
- 1022674 vdb-entry
- 28985 third-party-advisory
- 31326 third-party-advisory
- 27786 vdb-entry
- https://issues.rpath.com/browse/RPL-2503
- http://pcre.org/changelog.txt
- ADV-2008-2780 vdb-entry
- FEDORA-2008-1783 vendor-advisory
- USN-581-1 vendor-advisory
- https://issues.rpath.com/browse/RPL-2223
- ADV-2008-0570 vdb-entry
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216
- ADV-2009-2172 vdb-entry
- TA09-218A third-party-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0086
- 30048 third-party-advisory