Home / mailings [RHSA-2007:1059-01] Important: pcre security update
Posted on 03 December 2007
RedHat-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: pcre security update
Advisory ID: RHSA-2007:1059-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1059.html
Issue date: 2007-11-29
Updated on: 2007-11-29
Product: Red Hat Enterprise Linux
CVE Names: CVE-2006-7225 CVE-2006-7226 CVE-2006-7228
CVE-2006-7230
- ---------------------------------------------------------------------
1. Summary:
Updated pcre packages that resolve several security issues are now
available for Red Hat Enterprise Linux 5.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
3. Problem description:
PCRE is a Perl-compatible regular expression library.
Flaws were discovered in the way PCRE handles certain malformed regular
expressions. If an application linked against PCRE, such as Konqueror,
parses a malicious regular expression, it may have been possible to run
arbitrary code as the user running the application.
(CVE-2006-7225, CVE-2006-7226, CVE-2006-7228, CVE-2006-7230)
Users of PCRE are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues.
Red Hat would like to thank Ludwig Nussel for reporting these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bug IDs fixed (http://bugzilla.redhat.com/):
383371 - CVE-2006-7228 pcre integer overflow
384761 - CVE-2006-7225 pcre miscalculation of memory requirements for malformed Posix character class
384781 - CVE-2006-7226 pcre miscalculation of memory requirements for repeated subpattern containing a named recursion or subroutine reference
384801 - CVE-2006-7230 pcre miscalculation of memory requirements if options are changed during pattern compilation
6. RPMs required:
Red Hat Enterprise Linux Desktop (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pcre-6.6-2.el5_1.7.src.rpm
7cc3f071a95e8dabeae35ea9bb35bf44 pcre-6.6-2.el5_1.7.src.rpm
i386:
d201068ae3b6af398aad8e3fedd2875e pcre-6.6-2.el5_1.7.i386.rpm
a7608c94759540227129fec7616f0586 pcre-debuginfo-6.6-2.el5_1.7.i386.rpm
x86_64:
d201068ae3b6af398aad8e3fedd2875e pcre-6.6-2.el5_1.7.i386.rpm
408ac25d3001d6df1e1a1373b70efe74 pcre-6.6-2.el5_1.7.x86_64.rpm
a7608c94759540227129fec7616f0586 pcre-debuginfo-6.6-2.el5_1.7.i386.rpm
1f6c032ee4cf2e520dfc2b94af4d8e7c pcre-debuginfo-6.6-2.el5_1.7.x86_64.rpm
RHEL Desktop Workstation (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pcre-6.6-2.el5_1.7.src.rpm
7cc3f071a95e8dabeae35ea9bb35bf44 pcre-6.6-2.el5_1.7.src.rpm
i386:
a7608c94759540227129fec7616f0586 pcre-debuginfo-6.6-2.el5_1.7.i386.rpm
a28a9ee687328bc25eb01588c8738784 pcre-devel-6.6-2.el5_1.7.i386.rpm
x86_64:
a7608c94759540227129fec7616f0586 pcre-debuginfo-6.6-2.el5_1.7.i386.rpm
1f6c032ee4cf2e520dfc2b94af4d8e7c pcre-debuginfo-6.6-2.el5_1.7.x86_64.rpm
a28a9ee687328bc25eb01588c8738784 pcre-devel-6.6-2.el5_1.7.i386.rpm
b9f543c695ad7d8141a5c2fd80692981 pcre-devel-6.6-2.el5_1.7.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/pcre-6.6-2.el5_1.7.src.rpm
7cc3f071a95e8dabeae35ea9bb35bf44 pcre-6.6-2.el5_1.7.src.rpm
i386:
d201068ae3b6af398aad8e3fedd2875e pcre-6.6-2.el5_1.7.i386.rpm
a7608c94759540227129fec7616f0586 pcre-debuginfo-6.6-2.el5_1.7.i386.rpm
a28a9ee687328bc25eb01588c8738784 pcre-devel-6.6-2.el5_1.7.i386.rpm
ia64:
7d60719573aecd2222867ddbe66bbe6c pcre-6.6-2.el5_1.7.ia64.rpm
2a5a73c832ba4f60ecf4dfad7b99c78a pcre-debuginfo-6.6-2.el5_1.7.ia64.rpm
df733a18eee9d49b391b21e048eee94f pcre-devel-6.6-2.el5_1.7.ia64.rpm
ppc:
12d9ca99b5c09e31a4945526dc22e881 pcre-6.6-2.el5_1.7.ppc.rpm
955028fb20133c35e15d4ca6036ba226 pcre-6.6-2.el5_1.7.ppc64.rpm
ac6427735ecb436b105ca5b4643a857a pcre-debuginfo-6.6-2.el5_1.7.ppc.rpm
432b54afab5a5e6f98c21629027a9dbf pcre-debuginfo-6.6-2.el5_1.7.ppc64.rpm
6858d1c5a378e8957e1dba0d2d18850c pcre-devel-6.6-2.el5_1.7.ppc.rpm
72331b7d69a6f8ae26dff73b3529bc71 pcre-devel-6.6-2.el5_1.7.ppc64.rpm
s390x:
4d7d135ce1ad2cb90de046aa30091e13 pcre-6.6-2.el5_1.7.s390.rpm
b0c3c10df3700779b4196686e6724b54 pcre-6.6-2.el5_1.7.s390x.rpm
dd5ad0c3bb9b1205875f69e48ffcdeb2 pcre-debuginfo-6.6-2.el5_1.7.s390.rpm
c53c6d37bc7bc35946c2f4ce049609ba pcre-debuginfo-6.6-2.el5_1.7.s390x.rpm
6e24bad9004f1803d75c7de2de5d5512 pcre-devel-6.6-2.el5_1.7.s390.rpm
8f07ac7aee4d20b28aa8ebe5e0203d55 pcre-devel-6.6-2.el5_1.7.s390x.rpm
x86_64:
d201068ae3b6af398aad8e3fedd2875e pcre-6.6-2.el5_1.7.i386.rpm
408ac25d3001d6df1e1a1373b70efe74 pcre-6.6-2.el5_1.7.x86_64.rpm
a7608c94759540227129fec7616f0586 pcre-debuginfo-6.6-2.el5_1.7.i386.rpm
1f6c032ee4cf2e520dfc2b94af4d8e7c pcre-debuginfo-6.6-2.el5_1.7.x86_64.rpm
a28a9ee687328bc25eb01588c8738784 pcre-devel-6.6-2.el5_1.7.i386.rpm
b9f543c695ad7d8141a5c2fd80692981 pcre-devel-6.6-2.el5_1.7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7225
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7226
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7228
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7230
http://www.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc.
