CVE-2007-1661
Perl-Compatible Regular Expression (PCRE) library before 7.3 backtracks too far when matching...
Perl-Compatible Regular Expression (PCRE) library before 7.3 backtracks too far when matching certain input bytes against some regex patterns in non-UTF-8 mode, which allows context-dependent attackers to obtain sensitive information or cause a denial of service (crash), as demonstrated by the "\X?\d" and "\P{L}?\d" patterns.
Exploit likelihood
What each source reports
NVD Score used
6.4
Perl-Compatible Regular Expression (PCRE) library before 7.3 backtracks too far when matching certain input bytes against some regex patterns in non-UTF-8 mode, which allows context-dependent attackers to obtain sensitive information or cause a denial of service (crash), as demonstrated by the "\X?\d" and "\P{L}?\d" patterns.
- Record
CVE-2007-1661- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Perl-Compatible Regular Expression (PCRE) library before 7.3 backtracks too far when matching certain input bytes against some regex patterns in non-UTF-8 mode, which allows context-dependent attackers to obtain sensitive information or cause a denial of service (crash), as demonstrated by the "\X?\d" and "\P{L}?\d" patterns.
- Record
CVE-2007-1661- Updated
- 2026-11-02
EUVDEUVD-2007-1655 No score
Perl-Compatible Regular Expression (PCRE) library before 7.3 backtracks too far when matching certain input bytes against some regex patterns in non-UTF-8 mode, which allows context-dependent attackers to obtain sensitive information or cause a denial of service (crash), as demonstrated by the "\X?\d" and "\P{L}?\d" patterns.
- Record
EUVD-2007-1655- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-759q-4q8w-5gfh No score
Perl-Compatible Regular Expression (PCRE) library before 7.3 backtracks too far when matching...
Perl-Compatible Regular Expression (PCRE) library before 7.3 backtracks too far when matching certain input bytes against some regex patterns in non-UTF-8 mode, which allows context-dependent attackers to obtain sensitive information or cause a denial of service (crash), as demonstrated by the "\X?\d" and "\P{L}?\d" patterns.
- Record
GHSA-759q-4q8w-5gfh- Updated
- 2026-11-02
OSV No score
Perl-Compatible Regular Expression (PCRE) library before 7.3 backtracks too far when matching certain input bytes against some regex patterns in non-UTF-8 mode, which allows context-dependent attackers to obtain sensitive information or cause a denial of service (crash), as demonstrated by the "\X?\d" and "\P{L}?\d" patterns.
- Record
CVE-2007-1661- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-1661 No score
Perl-Compatible Regular Expression (PCRE) library before 7.3 backtracks too far when matching certain input bytes against some regex patterns in non-UTF-8 mode, which allows context-dependent attackers to obtain sensitive information or cause a denial of service (crash), as demonstrated by the "\X?\d" and "\P{L}?\d" patterns.
- Record
DEBIAN-CVE-2007-1661- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glib2.0Debian:12 |
before 2.14.3-1 | 2.14.3-1 |
glib2.0Debian:13 |
before 2.14.3-1 | 2.14.3-1 |
glib2.0Debian:14 |
before 2.14.3-1 | 2.14.3-1 |
pcre3Debian:12 |
before 7.3-1 | 7.3-1 |
pcre3Debian:3.1 From an advisory covering 7 CVEs |
before 4.5+7.4-1, plus listed versions 4.5-1.24.5-1.2sarge1 |
4.5+7.4-1 |
pcre3Debian:4.0 From an advisory covering 7 CVEs |
before 6.7+7.4-2, plus listed versions 6.7+7.4-16.7-1 |
6.7+7.4-2 |
kazehakaseDebian:4.0 From an advisory covering 10 CVEs |
before 0.4.2-1etch1, plus listed versions 0.4.2-1 |
0.4.2-1etch1 |
pcre3Debian:5.0 From an advisory covering 7 CVEs |
before 6.7+7.4-2+lenny1 | 6.7+7.4-2+lenny1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| aliases | ||
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-1661 is a medium vulnerability (CVSS 6.4) in Apple Mac Os X, published November 5, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.49%, the 84th percentile. Fixed in glib2.0 2.14.3-1.
References
secunia.com/advisories/30219
secunia.com/advisories/29267
usn.ubuntu.com/547-1
security.gentoo.org/glsa/glsa-200711-30.xml
vupen.com/english/advisories/2007/4238
securityfocus.com/archive/1/483357/100/0/threaded
Show 41 moreShow less
us-cert.gov/cas/techalerts/TA07-352A.html
secunia.com/advisories/27538
securityfocus.com/archive/1/483579/100/0/threaded
secunia.com/advisories/28136
debian.org/security/2008/dsa-1570
issues.rpath.com/browse/RPL-1738
secunia.com/advisories/27773
secunia.com/advisories/27697
secunia.com/advisories/28406
secunia.com/advisories/27554
vupen.com/english/advisories/2008/0924/references
exchange.xforce.ibmcloud.com/vulnerabilities/38274
secunia.com/advisories/27543
mail.gnome.org/archives/gtk-devel-list/2007-November/msg00022.html
secunia.com/advisories/29420
lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
security.gentoo.org/glsa/glsa-200805-11.xml
lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
mandriva.com/security/advisories?name=MDKSA-2007:211
redhat.com/archives/fedora-package-announce/2008-March/msg00181.html
docs.info.apple.com/article.html?artnum=307179
secunia.com/advisories/27741
vupen.com/english/advisories/2007/3790
vupen.com/english/advisories/2007/3725
novell.com/linux/security/advisories/2007_62_pcre.html
pcre.org/changelog.txt
docs.info.apple.com/article.html?artnum=307562
secunia.com/advisories/30155
secunia.com/advisories/28720
security.gentoo.org/glsa/glsa-200801-02.xml
bugs.gentoo.org/show_bug.cgi?id=198976
security.gentoo.org/glsa/glsa-200801-19.xml
security.gentoo.org/glsa/glsa-200801-18.xml
debian.org/security/2007/dsa-1399
secunia.com/advisories/28414
securityfocus.com/bid/26346
secunia.com/advisories/30106
secunia.com/advisories/28714
nvd.nist.gov/vuln/detail/CVE-2007-1661
github.com/advisories/GHSA-759q-4q8w-5gfh
security-tracker.debian.org/tracker/CVE-2007-1661