Out-of-Bounds Write in PCRE2 Affecting Multiple Versions
CVE-2017-8399

9.8CRITICAL

Key Information:

Vendor

Pcre

Status
Pcre2
Vendor
CVE Published:
1 May 2017

What is CVE-2017-8399?

PCRE2 prior to version 10.30 exhibits a vulnerability enabling an out-of-bounds write, resulting from a stack-based buffer overflow in pcre2_match.c. This issue occurs when processing patterns with an excessive number of captures, potentially leading to memory corruption and stability issues in applications utilizing the PCRE2 library.

References

https://security.gentoo.org/glsa/201710-09
vendor-advisoryx_refsource_GENTOO
https://vcs.pcre.org/pcre2/code/tags/pcre2-10.30/ChangeLo...
x_refsource_CONFIRM
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=783
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.