CLD-66 Details

Other IDs this deficiency may be known by:

CVE ID CVE-2017-7186 (nvd) (mitre) (debian) (archlinux) (red hat) (suse) (ubuntu)
Other ID(s)

Basic Information:

Affected Package(s) pcre
Deficiency Type SECURITY
Date Created 2017-10-08 10:39:00
Date Last Modified 2017-10-08 15:13:35

Version Specific Information:

Cucumber 1.0 i686 fixed in pcre-8.41-i686-1
Cucumber 1.0 x86_64 fixed in pcre-8.41-x86_64-1

Cucumber 1.1 i686 fixed in pcre-8.41-i686-1
Cucumber 1.1 x86_64 fixed in pcre-8.41-x86_64-1

Details:

libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to
cause a denial of service (segmentation violation for read access, and
application crash) by triggering an invalid Unicode property lookup
(https://nvd.nist.gov/vuln/detail/CVE-2017-7186).

This vulnerability has been anaylized extensively on the Gentoo blog. They claim
that this vulnerability has been fixed in pcre 8.41
(https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-match-pcre_exec-c/).