CVE-2005-4872: pcre

Vulnerability summary

CVE-2005-4872 is a medium (CVSS 4.3) vulnerability in pcre. EPSS estimates a 2.32% chance of exploitation in the next 30 days, higher than 83.4% of scored vulnerabilities.

Timeline

1. 14-11-2007
   PublishedVulnerability first disclosed.
2. 08-08-2024
   Last modifiedVulnerability information updated.

Description

Perl-Compatible Regular Expression (PCRE) library before 6.2 does not properly count the number of named capturing subpatterns, which allows context-dependent attackers to cause a denial of service (crash) via a regular expression with a large number of named subpatterns, which triggers a buffer overflow. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.