VulnerabilityModified
CVE-2017-7186
libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup.
HIGH 7.5EPSS 5.03%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.03%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 5.03% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- pcre/pcre · pcre/pcre2
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/97030
- https://access.redhat.com/errata/RHSA-2018:2486
- https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-match-pcre_exec-c/Patch, Third Party Advisory
- https://bugs.exim.org/show_bug.cgi?id=2052Third Party Advisory
- https://security.gentoo.org/glsa/201710-09
- https://security.gentoo.org/glsa/201710-25
- https://vcs.pcre.org/pcre/code/trunk/pcre_internal.h?r1=1649&r2=1688&sortby=datePatch
- https://vcs.pcre.org/pcre/code/trunk/pcre_ucd.c?r1=1490&r2=1688&sortby=datePatch
- https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_internal.h?r1=600&r2=670&sortby=datePatch
- https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_ucd.c?r1=316&r2=670&sortby=datePatch
- http://www.securityfocus.com/bid/97030
- https://access.redhat.com/errata/RHSA-2018:2486
- https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-match-pcre_exec-c/Patch, Third Party Advisory
- https://bugs.exim.org/show_bug.cgi?id=2052Third Party Advisory
- https://security.gentoo.org/glsa/201710-09
- https://security.gentoo.org/glsa/201710-25
- https://vcs.pcre.org/pcre/code/trunk/pcre_internal.h?r1=1649&r2=1688&sortby=datePatch
- https://vcs.pcre.org/pcre/code/trunk/pcre_ucd.c?r1=1490&r2=1688&sortby=datePatch
- https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_internal.h?r1=600&r2=670&sortby=datePatch
- https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_ucd.c?r1=316&r2=670&sortby=datePatch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.