oss-sec mailing list archives
CVE-2017-11164 - stack exhaustion in PCRE
From: Sevan Janiyan <venture37 () geeklan co uk>
Date: Tue, 11 Apr 2023 12:22:34 +0100
Hi, CVE-2017-11164 landed some years back[1] for PCRE 8.x and is markedup with a high base score on the article[2], yet no fix was ever listed and is still commonly packaged, so I asked Philip Hazel (the PCRE maintainer) regarding the issue, and this is what Philip said
"Stack exhaustion is a FEP (frequently encountered problem) in PCRE1 (the 8.xx series). There are various limiting options that the user can apply to limit stack usage. ... The code in PCRE2 has been re-written so as to use heap storage instead of the stack when executing patterns, thus getting rid of a problem that lots of people encountered with PCRE1." "PCRE1 has become totally obsolete and is no longer maintained. The final release was 8.45 (June 2021)" So just a heads up if you're still linking against PCRE 8.x but software in question supports PCRE2, perhaps it's time to switch and default to PCRE2. Sevan [1] https://www.openwall.com/lists/oss-security/2017/07/11/3 [2] https://nvd.nist.gov/vuln/detail/CVE-2017-11164
Current thread:
- CVE-2017-11164 - stack exhaustion in PCRE Sevan Janiyan (Apr 11)
- Re: CVE-2017-11164 - stack exhaustion in PCRE Matthew Vernon (Apr 12)