614052 – (CVE-2017-7245, CVE-2017-7246) <dev-libs/libpcre-8.41: two stack-based buffer overflow write in pcre32_copy_substring (pcre_get.c)

Bug 614052 (CVE-2017-7245, CVE-2017-7246) - <dev-libs/libpcre-8.41: two stack-based buffer overflow write in pcre32_copy_substring (pcre_get.c)

Summary: <dev-libs/libpcre-8.41: two stack-based buffer overflow write in pcre32_copy_...

Status:	RESOLVED FIXED

Alias:	CVE-2017-7245, CVE-2017-7246

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal normal (vote)
Assignee:	Gentoo Security

URL:	https://blogs.gentoo.org/ago/2017/03/...
Whiteboard:	A3 [glsa cve]
Keywords:

Depends on:
Blocks:	614048 CVE-2017-7244
	Show dependency tree

Reported:	2017-03-27 09:48 UTC by Agostino Sarubbo
Modified:	2018-03-23 23:25 UTC (History)
CC List:	1 user (show)

See Also:
Package list:	dev-libs/libpcre-8.41
Runtime testing required:	---

Flags:	stable-bot: sanity-check+

Attachments
Patch for CVE-2017-7245 (CVE-2017-7245.patch,1.35 KB, patch) 2017-06-03 21:06 UTC, Thomas Deutschmann (RETIRED)	no flags	Details \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Agostino Sarubbo gentoo-dev

2017-03-27 09:48:10 UTC

Details at $URL.


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

Comment 1 Yury German Gentoo Infrastructure

2017-03-28 04:38:58 UTC

CVE ID: CVE-2017-7245
Summary: Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.
Published: 2017-03-23T21:59:00.000Z

Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev

2017-06-03 21:06:01 UTC

Created attachment 475124 [details, diff]
Patch for CVE-2017-7245

Comment 3 Volkan 2017-06-06 14:46:30 UTC

There seems to be a second CVE number for this CVE-2017-7246 

CVE-2017-7245 - https://bugzilla.redhat.com/show_bug.cgi?id=1437367
CVE-2017-7246 - https://bugzilla.redhat.com/show_bug.cgi?id=1437369

Comment 4 Thomas Deutschmann (RETIRED) gentoo-dev

2017-08-18 16:58:12 UTC

Both issues fixed in >=dev-libs/libpcre-8.41.

Comment 5 Thomas Deutschmann (RETIRED) gentoo-dev

2017-08-18 19:14:27 UTC

x86 stable

Comment 6 Sergei Trofimovich (RETIRED) gentoo-dev

2017-08-18 20:46:28 UTC

ia64 stable

Comment 7 Markus Meier gentoo-dev

2017-08-25 04:44:21 UTC

arm stable

Comment 8 Mikle Kolyada (RETIRED) archtester

2017-08-26 08:57:26 UTC

amd64 stable

Comment 9 Matt Turner gentoo-dev

2017-08-31 15:21:33 UTC

alpha stable

Comment 10 Aaron Bauman (RETIRED) gentoo-dev

2017-09-10 22:17:21 UTC

sparc was dropped to exp.

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b5901d8f716555a1479f12313a2925fcadd177a9

Comment 11 Sergei Trofimovich (RETIRED) gentoo-dev

2017-09-25 21:43:32 UTC

ppc64 stable

Comment 12 Sergei Trofimovich (RETIRED) gentoo-dev

2017-09-25 21:51:51 UTC

ppc stable

Comment 13 Sergei Trofimovich (RETIRED) gentoo-dev

2017-09-26 21:24:30 UTC

hppa stable

Comment 14 GLSAMaker/CVETool Bot gentoo-dev

2017-10-23 01:20:15 UTC

This issue was resolved and addressed in
 GLSA 201710-25 at https://security.gentoo.org/glsa/201710-25
by GLSA coordinator Aaron Bauman (b-man).

Comment 15 Aaron Bauman (RETIRED) gentoo-dev

2017-10-23 01:21:42 UTC

re-opened for cleanup

Comment 16 Sergei Trofimovich (RETIRED) gentoo-dev

2017-10-24 18:55:59 UTC

sparc stable (thanks to Rolf Eike Beer)

Comment 17 Mart Raudsepp gentoo-dev

2018-03-02 11:45:14 UTC

arm64 stable  (well, -r1 instead, for which we for some reason weren't CCed for)

Comment 18 Aaron Bauman (RETIRED) gentoo-dev

2018-03-23 23:25:03 UTC

tree is clean.