CVE-2019-20454: High severity PCRE pcre2 vulnerability
A flaw was found in libpcre. A buffer overread in JIT mode when \X is used in non-UTF mode may cause application crash and denial of service. The flaw is in function doextuninoutf() in pcre2jitcompile.c, which uses the macro GETCHARINC to read a character. However, in case there is an invalid UTF character the value read is too big, which causes an out-of-bounds read in the next statement, while executing macro UCDGRAPHBREAK.
References:
https://bugs.exim.org/showbug.cgi?id=2421 https://bugzilla.redhat.com/showbug.cgi?id=1734468
Upstream patch:
http://git.php.net/?p=php-src.git;a=commitdiff;h=8947fd9e9fdce87cd6c59817b1db58e789538fe9
Other sources
An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in doextuninoutf in pcre2jitcompile.c.
An out-of-bounds read was discovered in PCRE when the pattern "\X" is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to crash the application.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-20454?
CVE-2019-20454 is an out-of-bounds read vulnerability in PCRE that can lead to application crashes.
How does CVE-2019-20454 affect PCRE?
CVE-2019-20454 affects PCRE versions before 10.34 when the \X pattern is JIT compiled and used to match specially crafted subjects in non-UTF mode.
What is the severity of CVE-2019-20454?
CVE-2019-20454 has a severity rating of 7.5 (high).
How can CVE-2019-20454 be exploited?
CVE-2019-20454 can be exploited by an attacker using specially crafted subjects to crash applications that use PCRE for parsing untrusted input.
Is there a fix for CVE-2019-20454?
Yes, PCRE version 10.34 or higher includes a fix for CVE-2019-20454.