CVE-2006-7226

pcre miscalculation of memory requirements for repeated subpattern containing a named recursion or subroutine reference

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Perl-Compatible Regular Expression (PCRE) library before 6.7 does not properly calculate the compiled memory allocation for regular expressions that involve a quantified "subpattern containing a named recursion or subroutine reference," which allows context-dependent attackers to cause a denial of service (error or crash).

La biblioteca Perl-Compatible Regular Expression (PCRE) versiones anteriores a 6.7 no calcula apropiadamente la ubicación de memoria compilada para expresiones regulares que involucran un "subpatrón conteniendo un recursión nombrada ó referencia a subrutina" cuantificado, lo cual permite a atacantes locales o remotos dependientes del contexto provocar una denegación de servicio (error o caída)

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-11-13 CVE Reserved
2007-12-03 CVE Published
2024-08-07 CVE Updated
2024-08-29 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (13)

URL	Tag	Source
http://secunia.com/advisories/28041	Third Party Advisory
http://secunia.com/advisories/28658	Third Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2007-505.htm	X_refsource_confirm
http://www.pcre.org/changelog.txt	X_refsource_confirm
http://www.securityfocus.com/bid/26727	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/40020	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11545	Signature

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html	2017-10-11
http://www.mandriva.com/security/advisories?name=MDVSA-2008:030	2017-10-11
http://www.redhat.com/support/errata/RHSA-2007-1059.html	2017-10-11
http://www.redhat.com/support/errata/RHSA-2007-1068.html	2017-10-11
https://bugzilla.redhat.com/show_bug.cgi?id=384781	2007-11-29
https://access.redhat.com/security/cve/CVE-2006-7226	2007-11-29

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"		Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop"				4.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "4.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				4.0 Search vendor "Redhat" for product "Enterprise Linux" and version "4.0"		as		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				4.0 Search vendor "Redhat" for product "Enterprise Linux" and version "4.0"		es		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				4.0 Search vendor "Redhat" for product "Enterprise Linux" and version "4.0"		ws		Affected