CVE-2020-14155

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

PCRE is a Perl-compatible regular expression library.

Security Fix(es):

• pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 (CVE-2019-20838)

• pcre: Integer overflow when parsing callout numeric arguments (CVE-2020-14155)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

PCRE is a Perl-compatible regular expression library.

Security Fix(es):

• pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 (CVE-2019-20838)

• pcre: Integer overflow when parsing callout numeric arguments (CVE-2020-14155)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

This update for pcre fixes the following issues:

Update pcre to version 8.45:

• CVE-2020-14155: Fixed integer overflow via a large number after a '(?C' substring (bsc#1172974).
• CVE-2019-20838: Fixed buffer over-read in JIT compiler (bsc#1172973)

This update was imported from the SUSE:SLE-15:Update update project.

This update for pcre fixes the following issues:

Update pcre to version 8.45:

• CVE-2020-14155: Fixed integer overflow via a large number after a '(?C' substring (bsc#1172974).
• CVE-2019-20838: Fixed buffer over-read in JIT compiler (bsc#1172973)

This update for pcre fixes the following issues:

Update pcre to version 8.45:

• CVE-2020-14155: Fixed integer overflow via a large number after a '(?C' substring (bsc#1172974).
• CVE-2019-20838: Fixed buffer over-read in JIT compiler (bsc#1172973)

This update for pcre fixes the following issues:

Update pcre to version 8.45:

• CVE-2020-14155: Fixed integer overflow via a large number after a '(?C' substring (bsc#1172974).
• CVE-2019-20838: Fixed buffer over-read in JIT compiler (bsc#1172973).
• CVE-2017-7244: Fixed invalid read in _pcre32_xclass() (bsc#1030807).
• CVE-2017-7245: Fixed buffer overflow in the pcre32_copy_substring (bsc#1030805).
• CVE-2017-7246: Fixed another buffer overflow in the pcre32_copy_substring (bsc#1030803).
• CVE-2017-7186: Fixed denial of service caused by an invalid Unicode property lookup (bsc#1030066).
• CVE-2017-6004: Fixed denial of service via crafted regular expression (bsc#1025709).

Yunho Kim discovered that PCRE incorrectly handled memory when handling certain regular expressions. An attacker could possibly use this issue to cause applications using PCRE to expose sensitive information. This issue only affects Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 21.10 and Ubuntu 22.04 LTS. (CVE-2019-20838)

It was discovered that PCRE incorrectly handled memory when handling certain regular expressions. An attacker could possibly use this issue to cause applications using PCRE to have unexpected behavior. This issue only affects Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14155)