CVE-2019-20454

Source

https://nvd.nist.gov/vuln/detail/CVE-2019-20454

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-20454.json

Related

• ALSA-2020:3662
• ALSA-2020:4539
• DLA-3363-1
• RLSA-2020:3662
• RLSA-2020:4539

Published

2020-02-14T14:15:10Z

Modified

2024-03-27T16:05:17Z

Details

An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in doextuninoutf in pcre2jit_compile.c.

References

• https://security.gentoo.org/glsa/202006-16
• https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQRAHYHLRNMBTPR3KXVM27NSZP3KTOPI/
• https://bugs.php.net/bug.php?id=78338
• https://bugzilla.redhat.com/show_bug.cgi?id=1735494
• https://vcs.pcre.org/pcre2?view=revision&revision=1092
• https://bugs.exim.org/show_bug.cgi?id=2421