CVE-2019-20454
HighCVSS 7.5Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.
Risk Assessment
Applications using PCRE to parse untrusted input may be vulnerable, allowing an attacker to crash the application and cause a denial of service.
Recommendation
Update PCRE to version 10.34 or later and review applications that process untrusted input for PCRE usage.
Other vulnerabilities in PCRE
See all- CVE-2017-11164High
In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.
- CVE-2014-9769High
PCRE 8.35 has an issue with optimizing nested alternatives, which can lead to denial of service through stack memory corruption. Remote attackers can exploit this vulnerability by sending a crafted string.
- CVE-2015-8395High
PCRE before 8.38 mishandles certain references, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8392High
PCRE before 8.38 mishandles certain instances of the (?| substring, allowing remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8388High
PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8387High
PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, allowing remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-2328High
PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2020-14155Medium
The libpcre library in PCRE before version 8.44 is vulnerable to an integer overflow. The issue occurs when a large number is used after the (?C substring in a regular expression.
- CVE-2017-13846Critical
An issue was discovered in certain Apple products, including macOS before 10.13.1, related to the third-party 'PCRE' product. Versions before 8.40 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
- CVE-2016-1283Critical
The pcre_compile2 function in PCRE 8.38 mishandles patterns with named subgroups, potentially leading to a heap-based buffer overflow. Remote attackers can exploit this vulnerability by sending a crafted regular expression.
Original NVD description (English source)
An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS