1. CVE-Search
  2. CVE-2006-7227
ID CVE-2006-7227
Summary Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (name_count) or long subpattern names (max_name_size), which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
References
Vulnerable Configurations
  • cpe:2.3:a:pcre:pcre:1.00:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:1.00:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:1.01:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:1.01:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:1.02:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:1.02:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:1.03:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:1.03:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:1.04:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:1.04:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:1.05:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:1.05:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:1.06:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:1.06:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:1.07:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:1.07:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:1.08:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:1.08:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:1.09:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:1.09:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:2.00:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:2.00:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:2.01:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:2.01:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:2.02:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:2.02:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:2.03:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:2.03:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:2.04:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:2.04:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:2.05:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:2.05:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:2.06:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:2.06:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:2.07:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:2.07:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:2.08:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:2.08:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:2.08a:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:2.08a:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:3.0:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:3.1:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:3.2:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:3.3:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:3.4:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:3.5:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:3.6:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:3.7:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:3.7:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:3.8:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:3.8:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:3.9:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:3.9:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:4.0:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:4.1:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:4.2:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:4.3:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:4.4:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:4.5:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:4.5:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:5.0:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:6.0:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:6.1:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:6.2:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:6.3:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:6.4:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:6.5:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:6.5:*:*:*:*:*:*:*
  • cpe:2.3:a:pcre:pcre:6.6:*:*:*:*:*:*:*
    cpe:2.3:a:pcre:pcre:6.6:*:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 13-02-2023 - 02:17)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
oval via4
accepted 2013-04-29T04:05:24.773-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (name_count) or long subpattern names (max_name_size), which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
family unix
id oval:org.mitre.oval:def:10408
status accepted
submitted 2010-07-09T03:56:16-04:00
title Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to execute arbitrary code via a regular expression containing a large number of named subpatterns (name_count) or long subpattern names (max_name_size), which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
version 30
redhat via4
advisories
bugzilla
id 383361
title CVE-2005-4872 pcre incorrect memory requirement computation
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 4 is installed
      oval oval:com.redhat.rhba:tst:20070304025
    • OR
      • AND
        • comment pcre is earlier than 0:4.5-4.el4_5.4
          oval oval:com.redhat.rhsa:tst:20071052001
        • comment pcre is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20070968002
      • AND
        • comment pcre-devel is earlier than 0:4.5-4.el4_5.4
          oval oval:com.redhat.rhsa:tst:20071052003
        • comment pcre-devel is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20070968004
  • AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331005
    • OR
      • AND
        • comment pcre is earlier than 0:6.6-2.el5_1.1
          oval oval:com.redhat.rhsa:tst:20071052006
        • comment pcre is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070967002
      • AND
        • comment pcre-devel is earlier than 0:6.6-2.el5_1.1
          oval oval:com.redhat.rhsa:tst:20071052008
        • comment pcre-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070967004
rhsa
id RHSA-2007:1052
released 2007-11-10
severity Important
title RHSA-2007:1052: pcre security update (Important)
rpms
  • pcre-0:4.5-4.el4_5.4
  • pcre-0:6.6-2.el5_1.1
  • pcre-debuginfo-0:4.5-4.el4_5.4
  • pcre-debuginfo-0:6.6-2.el5_1.1
  • pcre-devel-0:4.5-4.el4_5.4
  • pcre-devel-0:6.6-2.el5_1.1
refmap via4
bid 26462
confirm
debian DSA-1570
gentoo
  • GLSA-200711-30
  • GLSA-200801-02
  • GLSA-200801-18
  • GLSA-200801-19
  • GLSA-200805-11
mandriva MDVSA-2008:030
misc
secunia
  • 27582
  • 27741
  • 27773
  • 27869
  • 28406
  • 28414
  • 28658
  • 28714
  • 28720
  • 30106
  • 30155
  • 30219
suse
  • SUSE-SA:2007:062
  • SUSE-SA:2008:004
Last major update 13-02-2023 - 02:17
Published 14-11-2007 - 21:46
Last modified 13-02-2023 - 02:17
Back to Top