CVE-2014-9769

Description

pcre_jit_compile.c in PCRE 8.35 does not properly use table jumps to optimize nested alternatives, which allows remote attackers to cause a denial of service (stack memory corruption) or possibly have unspecified other impact via a crafted string, as demonstrated by packets encountered by Suricata during use of a regular expression in an Emerging Threats Open ruleset.

Risk Information

Base Score

7.3

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score

Exploitation Probability

0.934

Associated Vulnerability

Vulnerability	OS Platform
Perl 5 Compatible Regular Expression Library (USN-2943-1) libpcre3_8.12-4ubuntu0.2_i386.deb	Linux
Perl 5 Compatible Regular Expression Library (USN-2943-1) libpcre3_8.12-4ubuntu0.2_amd64.deb	Linux
Perl 5 Compatible Regular Expression Library (USN-2943-1) libpcre3_8.31-2ubuntu2.2_i386.deb	Linux
Perl 5 Compatible Regular Expression Library (USN-2943-1) libpcre3_8.31-2ubuntu2.2_amd64.deb	Linux
Perl 5 Compatible Regular Expression Library (USN-2943-1) libpcre3_8.35-7.1ubuntu1.3_i386.deb	Linux
Perl 5 Compatible Regular Expression Library (USN-2943-1) libpcre3_8.35-7.1ubuntu1.3_amd64.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234