RedHat: Moderate: pcre security update
Summary
Summary
PCRE is a Perl-compatible regular expression library. Flaws were discovered in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE parses a malicious regular expression, it may have been possible to run arbitrary code as the user running the application. (CVE-2006-7228, CVE-2007-1660) Users of PCRE are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. Red Hat would like to thank Ludwig Nussel for reporting these issues.
Solution
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
5. Bug IDs fixed (http://bugzilla.redhat.com/):
315881 - CVE-2007-1660 pcre regular expression flaws
383371 - CVE-2006-7228 pcre integer overflow
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 :
SRPMS:
b022b4a160b9ae10502caf8f7f41e3df pcre-3.4-2.4.src.rpm
i386:
93b438935eef79a4694bce231c88677d pcre-3.4-2.4.i386.rpm
ba0028614c709b8890fa2df7f943a6ec pcre-devel-3.4-2.4.i386.rpm
ia64:
cdcd3056392e75214d16493b9e3a5cf5 pcre-3.4-2.4.ia64.rpm
bb8cf92b2f4f9a24653116e027a5ee2a pcre-devel-3.4-2.4.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
b022b4a160b9ae10502caf8f7f41e3df pcre-3.4-2.4.src.rpm
ia64:
cdcd3056392e75214d16493b9e3a5cf5 pcre-3.4-2.4.ia64.rpm
bb8cf92b2f4f9a24653116e027a5ee2a pcre-devel-3.4-2.4.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
b022b4a160b9ae10502caf8f7f41e3df pcre-3.4-2.4.src.rpm
i386:
93b438935eef79a4694bce231c88677d pcre-3.4-2.4.i386.rpm
ba0028614c709b8890fa2df7f943a6ec pcre-devel-3.4-2.4.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
b022b4a160b9ae10502caf8f7f41e3df pcre-3.4-2.4.src.rpm
i386:
93b438935eef79a4694bce231c88677d pcre-3.4-2.4.i386.rpm
ba0028614c709b8890fa2df7f943a6ec pcre-devel-3.4-2.4.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7228 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1660 http://www.redhat.com/security/updates/classification/#moderate
Package List
Topic
Topic
Relevant Releases Architectures
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Bugs Fixed