[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <94352367.aY5R7YHe3W@wanheda>
Date: Wed, 01 Nov 2017 16:29:32 +0100
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Cc: 旺仔 <16362505@...com>, cve-assign <cve-assign@...re.org>
Subject: Re: CVE-2017-16231: PCRE 8.41 match() stack overflow; CVE-2017-16232: LibTIFF 4.0.8 memory leaks
On mercoledì 1 novembre 2017 03:26:56 CET 旺仔 wrote:
> > [Suggested description]
> > In PCRE 8.41,
> > after compiling, a pcretest load test PoC produces a crash overflow
> > in the function match() in pcre_exec.c because of a self-recursive call.
> >
> >
> >
> > ------------------------------------------
> >
> >
> >
> > [Vulnerability Type]
> > Buffer Overflow
> >
> >
> >
> > ------------------------------------------
> >
> >
> >
> > [Vendor of Product]
> > Perl Compatible Regular Expressions
> >
> >
> >
> > ------------------------------------------
> >
> >
> >
> > [Affected Product Code Base]
> > PCRE - 8.41
> >
> >
> >
> > ------------------------------------------
> >
> >
> >
> > [Affected Component]
> > file:pcre_exec.c
> > function match() line 983 and line 2061
> >
> >
> >
> > ------------------------------------------
> >
> >
> >
> > [Attack Type]
> > Local
> >
> >
> >
> > ------------------------------------------
> >
> >
> >
> > [Impact Denial of Service]
> > true
> >
> >
> >
> > ------------------------------------------
> >
> >
> >
> > [Attack Vectors]
> > A crash file
> >
> >
> >
> > ------------------------------------------
> >
> >
> >
> > [Discoverer]
> > ZHANG JIAWANG from cncert
>
>
> Use CVE-2017-16231.
I guess that this bug is similar or the same described here:
https://bugs.exim.org/show_bug.cgi?id=2047
Based on the upstream comment I'd suggest to reject the CVE.
--
Agostino Sarubbo
Gentoo Linux Developer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
