CVE-2005-2491
pcre3 - buffer overflow
EPSS 2.0%
Description
Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow.
How to fix CVE-2005-2491
To remediate CVE-2005-2491, upgrade the affected package to a fixed version below.
- Debian/gnumeric—upgrade to 1.5.1-1 or later
- Debian/goffice—upgrade to 0.1.0-3 or later
- Debian/pcre3—upgrade to 3.4-1.1woody1 or later
- —upgrade to 6.3-0.1etch1 or later
- —upgrade to 6.3-1 or later
- —upgrade to 2.1.3-3.4 or later
- —upgrade to 2.2.1-4.8 or later
- —upgrade to 2.3.5-3sarge1 or later
Is CVE-2005-2491 being exploited?
Low — EPSS is 2.0%, meaning exploitation activity has not been observed at scale.
Affected packages (8)
- from 0, < 1.5.1-1
- from 0, < 0.1.0-3
- from 0, < 3.4-1.1woody1
- from 0, < 6.3-0.1etch1
- from 0, < 6.3-1
- from 0, < 2.1.3-3.4
- from 0, < 2.2.1-4.8
- from 0, < 2.3.5-3sarge1