Unscored severity · published Aug 23, 2005
CVE-2005-2491
Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to…
–
CVSS
4.3%
EPSS
No
On KEV
Description
Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.3% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
Pcre · Pcre
5.0; 6.0; 6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-2491
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-2491
docs.info.apple.com
http://docs.info.apple.com/article.html?artnum=302847
itrc.hp.com
http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522
lists.trustix.org
http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html
marc.info
http://marc.info/?l=bugtraq&m=112605112027335&w=2
More from Pcre
9.8
CVE-2015-3210
Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by…
9.8
CVE-2016-3191
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in…
9.8
CVE-2016-1283
The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the…
9.8
CVE-2015-8391
The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or…
9.1
CVE-2015-5073
Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive…