Skip to navigation

Security Advisory Important: pcre security update

Advisory: RHSA-2007:1059-9
Type: Security Advisory
Severity: Important
Issued on: 2007-11-29
Last updated on: 2007-11-29
Affected Products: RHEL Desktop Workstation (v. 5 client)
Red Hat Enterprise Linux (v. 5 server)
Red Hat Enterprise Linux Desktop (v. 5 client)
Red Hat Enterprise Linux EUS (v. 5.1.z server)
CVEs (cve.mitre.org): CVE-2006-7225
CVE-2006-7226
CVE-2006-7228
CVE-2006-7230

Details

Updated pcre packages that resolve several security issues are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

PCRE is a Perl-compatible regular expression library.

Flaws were discovered in the way PCRE handles certain malformed regular
expressions. If an application linked against PCRE, such as Konqueror,
parses a malicious regular expression, it may have been possible to run
arbitrary code as the user running the application.
(CVE-2006-7225, CVE-2006-7226, CVE-2006-7228, CVE-2006-7230)

Users of PCRE are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues.

Red Hat would like to thank Ludwig Nussel for reporting these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Updated packages

RHEL Desktop Workstation (v. 5 client)

SRPMS:
pcre-6.6-2.el5_1.7.src.rpm
File outdated by:  RHBA-2013:1298
    MD5: 7cc3f071a95e8dabeae35ea9bb35bf44
 
IA-32:
pcre-devel-6.6-2.el5_1.7.i386.rpm
File outdated by:  RHBA-2013:1298
    MD5: a28a9ee687328bc25eb01588c8738784
 
x86_64:
pcre-devel-6.6-2.el5_1.7.i386.rpm
File outdated by:  RHBA-2013:1298
    MD5: a28a9ee687328bc25eb01588c8738784
pcre-devel-6.6-2.el5_1.7.x86_64.rpm
File outdated by:  RHBA-2013:1298
    MD5: b9f543c695ad7d8141a5c2fd80692981
 
Red Hat Enterprise Linux (v. 5 server)

SRPMS:
pcre-6.6-2.el5_1.7.src.rpm
File outdated by:  RHBA-2013:1298
    MD5: 7cc3f071a95e8dabeae35ea9bb35bf44
 
IA-32:
pcre-6.6-2.el5_1.7.i386.rpm
File outdated by:  RHBA-2013:1298
    MD5: d201068ae3b6af398aad8e3fedd2875e
pcre-devel-6.6-2.el5_1.7.i386.rpm
File outdated by:  RHBA-2013:1298
    MD5: a28a9ee687328bc25eb01588c8738784
 
IA-64:
pcre-6.6-2.el5_1.7.ia64.rpm
File outdated by:  RHBA-2013:1298
    MD5: 7d60719573aecd2222867ddbe66bbe6c
pcre-devel-6.6-2.el5_1.7.ia64.rpm
File outdated by:  RHBA-2013:1298
    MD5: df733a18eee9d49b391b21e048eee94f
 
PPC:
pcre-6.6-2.el5_1.7.ppc.rpm
File outdated by:  RHBA-2013:1298
    MD5: 12d9ca99b5c09e31a4945526dc22e881
pcre-6.6-2.el5_1.7.ppc64.rpm
File outdated by:  RHBA-2013:1298
    MD5: 955028fb20133c35e15d4ca6036ba226
pcre-devel-6.6-2.el5_1.7.ppc.rpm
File outdated by:  RHBA-2013:1298
    MD5: 6858d1c5a378e8957e1dba0d2d18850c
pcre-devel-6.6-2.el5_1.7.ppc64.rpm
File outdated by:  RHBA-2013:1298
    MD5: 72331b7d69a6f8ae26dff73b3529bc71
 
s390x:
pcre-6.6-2.el5_1.7.s390.rpm
File outdated by:  RHBA-2013:1298
    MD5: 4d7d135ce1ad2cb90de046aa30091e13
pcre-6.6-2.el5_1.7.s390x.rpm
File outdated by:  RHBA-2013:1298
    MD5: b0c3c10df3700779b4196686e6724b54
pcre-devel-6.6-2.el5_1.7.s390.rpm
File outdated by:  RHBA-2013:1298
    MD5: 6e24bad9004f1803d75c7de2de5d5512
pcre-devel-6.6-2.el5_1.7.s390x.rpm
File outdated by:  RHBA-2013:1298
    MD5: 8f07ac7aee4d20b28aa8ebe5e0203d55
 
x86_64:
pcre-6.6-2.el5_1.7.i386.rpm
File outdated by:  RHBA-2013:1298
    MD5: d201068ae3b6af398aad8e3fedd2875e
pcre-6.6-2.el5_1.7.x86_64.rpm
File outdated by:  RHBA-2013:1298
    MD5: 408ac25d3001d6df1e1a1373b70efe74
pcre-devel-6.6-2.el5_1.7.i386.rpm
File outdated by:  RHBA-2013:1298
    MD5: a28a9ee687328bc25eb01588c8738784
pcre-devel-6.6-2.el5_1.7.x86_64.rpm
File outdated by:  RHBA-2013:1298
    MD5: b9f543c695ad7d8141a5c2fd80692981
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
pcre-6.6-2.el5_1.7.src.rpm
File outdated by:  RHBA-2013:1298
    MD5: 7cc3f071a95e8dabeae35ea9bb35bf44
 
IA-32:
pcre-6.6-2.el5_1.7.i386.rpm
File outdated by:  RHBA-2013:1298
    MD5: d201068ae3b6af398aad8e3fedd2875e
 
x86_64:
pcre-6.6-2.el5_1.7.i386.rpm
File outdated by:  RHBA-2013:1298
    MD5: d201068ae3b6af398aad8e3fedd2875e
pcre-6.6-2.el5_1.7.x86_64.rpm
File outdated by:  RHBA-2013:1298
    MD5: 408ac25d3001d6df1e1a1373b70efe74
 
Red Hat Enterprise Linux EUS (v. 5.1.z server)

SRPMS:
pcre-6.6-2.el5_1.7.src.rpm
File outdated by:  RHBA-2013:1298
    MD5: 7cc3f071a95e8dabeae35ea9bb35bf44
 
IA-32:
pcre-6.6-2.el5_1.7.i386.rpm     MD5: d201068ae3b6af398aad8e3fedd2875e
pcre-devel-6.6-2.el5_1.7.i386.rpm     MD5: a28a9ee687328bc25eb01588c8738784
 
IA-64:
pcre-6.6-2.el5_1.7.ia64.rpm     MD5: 7d60719573aecd2222867ddbe66bbe6c
pcre-devel-6.6-2.el5_1.7.ia64.rpm     MD5: df733a18eee9d49b391b21e048eee94f
 
PPC:
pcre-6.6-2.el5_1.7.ppc.rpm     MD5: 12d9ca99b5c09e31a4945526dc22e881
pcre-6.6-2.el5_1.7.ppc64.rpm     MD5: 955028fb20133c35e15d4ca6036ba226
pcre-devel-6.6-2.el5_1.7.ppc.rpm     MD5: 6858d1c5a378e8957e1dba0d2d18850c
pcre-devel-6.6-2.el5_1.7.ppc64.rpm     MD5: 72331b7d69a6f8ae26dff73b3529bc71
 
s390x:
pcre-6.6-2.el5_1.7.s390.rpm     MD5: 4d7d135ce1ad2cb90de046aa30091e13
pcre-6.6-2.el5_1.7.s390x.rpm     MD5: b0c3c10df3700779b4196686e6724b54
pcre-devel-6.6-2.el5_1.7.s390.rpm     MD5: 6e24bad9004f1803d75c7de2de5d5512
pcre-devel-6.6-2.el5_1.7.s390x.rpm     MD5: 8f07ac7aee4d20b28aa8ebe5e0203d55
 
x86_64:
pcre-6.6-2.el5_1.7.i386.rpm     MD5: d201068ae3b6af398aad8e3fedd2875e
pcre-6.6-2.el5_1.7.x86_64.rpm     MD5: 408ac25d3001d6df1e1a1373b70efe74
pcre-devel-6.6-2.el5_1.7.i386.rpm     MD5: a28a9ee687328bc25eb01588c8738784
pcre-devel-6.6-2.el5_1.7.x86_64.rpm     MD5: b9f543c695ad7d8141a5c2fd80692981
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

383371 - CVE-2006-7228 pcre integer overflow
384761 - CVE-2006-7225 pcre miscalculation of memory requirements for malformed Posix character class
384781 - CVE-2006-7226 pcre miscalculation of memory requirements for repeated subpattern containing a named recursion or subroutine reference
384801 - CVE-2006-7230 pcre miscalculation of memory requirements if options are changed during pattern compilation


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/