[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <55C05B73.7090607@redhat.com>
Date: Tue, 4 Aug 2015 11:58:03 +0530
From: Huzaifa Sidhpurwala <huzaifas@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: Information disclosure in pcre
On 08/04/2015 11:51 AM, Huzaifa Sidhpurwala wrote:
> Hi All,
>
> It was reported that pcre_exec in PHP pcre extenstion partially
> initialize a buffer when an invalid regex is processed, which can lead
> to an arbitrary code execution.
>
This should have been "which can lead to information disclosure"
Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=1187225
> https://bugs.exim.org/show_bug.cgi?id=1537
>
> This patch has been committed upstream via:
> http://vcs.pcre.org/pcre/code/trunk/pcre_exec.c?r1=1502&r2=1510
>
> And is a part of upstream release pcre-8.37
>
> This was initially reported by ZDI (ZDI-CAN-2547), but it seems there
> was no follow-up.
>
> Can a CVE id be please assigned to this issue?
>
--
Huzaifa Sidhpurwala / Red Hat Product Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
