CVE-2007-4768
Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows...
Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.
- Record
CVE-2007-4768- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.
- Record
CVE-2007-4768- Updated
- 2026-11-02
EUVDEUVD-2007-4749 No score
Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.
- Record
EUVD-2007-4749- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jq5c-rgv9-cw8p No score
Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows...
Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.
- Record
GHSA-jq5c-rgv9-cw8p- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.
- Record
CVE-2007-4768- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-4768 No score
Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.
- Record
DEBIAN-CVE-2007-4768- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glib2.0Debian:12 |
before 2.14.3-1 | 2.14.3-1 |
glib2.0Debian:13 |
before 2.14.3-1 | 2.14.3-1 |
glib2.0Debian:14 |
before 2.14.3-1 | 2.14.3-1 |
pcre3Debian:12 |
before 7.3-1 | 7.3-1 |
pcre3Debian:3.1 From an advisory covering 7 CVEs |
before 4.5+7.4-1, plus listed versions 4.5-1.24.5-1.2sarge1 |
4.5+7.4-1 |
pcre3Debian:4.0 From an advisory covering 7 CVEs |
before 6.7+7.4-2, plus listed versions 6.7+7.4-16.7-1 |
6.7+7.4-2 |
kazehakaseDebian:4.0 From an advisory covering 10 CVEs |
before 0.4.2-1etch1, plus listed versions 0.4.2-1 |
0.4.2-1etch1 |
pcre3Debian:5.0 From an advisory covering 7 CVEs |
before 6.7+7.4-2+lenny1 | 6.7+7.4-2+lenny1 |
flash-pluginRed Hat:rhel_extras:3 From an advisory covering 8 CVEs |
before 0:9.0.115.0-1.el3.with.oss | 0:9.0.115.0-1.el3.with.oss |
flash-pluginRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 0:9.0.115.0-1.el4 | 0:9.0.115.0-1.el4 |
flash-pluginRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 0:9.0.115.0-1.el5 | 0:9.0.115.0-1.el5 |
flash-pluginRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 0:9.0.115.0-1.el5 | 0:9.0.115.0-1.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| aliases | ||
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-4768 is a medium vulnerability (CVSS 6.8) in Pcre, published November 5, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.10%, the 90th percentile. Fixed in glib2.0 2.14.3-1.
References
secunia.com/advisories/30219
lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html
usn.ubuntu.com/547-1
security.gentoo.org/glsa/glsa-200711-30.xml
Show 91 moreShow less
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9701
vupen.com/english/advisories/2007/4238
securityfocus.com/archive/1/483357/100/0/threaded
us-cert.gov/cas/techalerts/TA07-352A.html
adobe.com/support/security/bulletins/apsb08-13.html
debian.org/security/2008/dsa-1570
issues.rpath.com/browse/RPL-1738
gentoo.org/security/en/glsa/glsa-200801-07.xml
mail.gnome.org/archives/gtk-devel-list/2007-November/msg00022.html
lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
mandriva.com/security/advisories?name=MDKSA-2007:211
sunsolve.sun.com/search/document.do?assetkey=1-26-239286-1
redhat.com/archives/fedora-package-announce/2008-March/msg00181.html
docs.info.apple.com/article.html?artnum=307179
securitytracker.com/id?1019116
exchange.xforce.ibmcloud.com/vulnerabilities/38278
bugs.gentoo.org/show_bug.cgi?id=198976
nvd.nist.gov/vuln/detail/CVE-2007-4768
github.com/advisories/GHSA-jq5c-rgv9-cw8p
security-tracker.debian.org/tracker/CVE-2007-4768
access.redhat.com/errata/RHSA-2007:1126
bugzilla.redhat.com/show_bug.cgi?id=252292
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_1126.json
cve.org/CVERecord?id=CVE-2007-4324