USN-547-1: PCRE vulnerabilities

27 November 2007

pcre3 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 7.10
  • Ubuntu 7.04
  • Ubuntu 6.10
  • Ubuntu 6.06 LTS

Software Description

  • pcre3

Details

Tavis Ormandy and Will Drewry discovered multiple flaws in the regular expression handling of PCRE. By tricking a user or service into running specially crafted expressions via applications linked against libpcre3, a remote attacker could crash the application, monopolize CPU resources, or possibly execute arbitrary code with the application’s privileges.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 7.10
libpcre3 - 7.4-0ubuntu0.7.10.1
libpcrecpp0 - 7.4-0ubuntu0.7.10.1
Ubuntu 7.04
libpcre3 - 7.4-0ubuntu0.7.04.1
libpcrecpp0 - 7.4-0ubuntu0.7.04.1
Ubuntu 6.10
libpcre3 - 7.4-0ubuntu0.6.10.1
libpcrecpp0 - 7.4-0ubuntu0.6.10.1
Ubuntu 6.06 LTS
libpcre3 - 7.4-0ubuntu0.6.06.1
libpcrecpp0 - 7.4-0ubuntu0.6.06.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system upgrade you need to reboot your computer to effect the necessary changes.

Due to the large internal code changes needed to solve outstanding flaws, it was not possible to backport all the upstream security fixes to the earlier released versions. To address this, the pcre3 library has been updated to the latest stable release (7.4), which includes fixes for all known security issues. While the new version is ABI compatible, efforts have been taken to maintain behavioral compatibility with the earlier versions.

References