Denial of Service Vulnerability in PCRE Software from Vendor PCRE
CVE-2014-9769

7.3HIGH

Key Information:

Vendor

Pcre

Status
Pcre
Vendor
CVE Published:
28 March 2016

What is CVE-2014-9769?

The vulnerability emanates from a flaw in the pcre_jit_compile.c file, found in PCRE version 8.35. It fails to correctly implement table jumps for optimizing nested alternatives, which can be exploited by remote attackers. By crafting a specific input string, attackers may induce stack memory corruption, leading to potential denial of service or other harmful effects. This was demonstrated through intercepted packets analyzed by Suricata while applying a regular expression within an Emerging Threats Open ruleset.

References

http://vcs.pcre.org/pcre?view=revision&revision=1475
x_refsource_CONFIRM
http://www.securityfocus.com/bid/85570
vdb-entryx_refsource_BID
https://redmine.openinfosecfoundation.org/issues/1693
x_refsource_CONFIRM

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.