LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: August 15th, 2014
Linux Advisory Watch: August 8th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
RedHat: Critical: pcre security update Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
RedHat Linux Updated pcre packages that correct two security flaws are now available for Red Hat Enterprise Linux 5. Multiple flaws were found in the way pcre handles certain malformed regular expressions. If an application linked against pcre, such as Konqueror, parses a malicious regular expression, it may be possible to run arbitrary code as the user running the application. This update has been rated as having critical security impact by the Red Hat Security Response Team.
- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Critical: pcre security update
Advisory ID:       RHSA-2007:0967-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2007-0967.html
Issue date:        2007-11-05
Updated on:        2007-11-05
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2007-1659 CVE-2007-1660 
- ---------------------------------------------------------------------

1. Summary:

Updated pcre packages that correct two security flaws are now available for
Red Hat Enterprise Linux 5.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Problem description:

PCRE is a Perl-compatible regular expression library.

Multiple flaws were found in the way pcre handles certain malformed regular
expressions. If an application linked against pcre, such as Konqueror,
parses a malicious regular expression, it may be possible to run arbitrary
code as the user running the application. (CVE-2007-1659, CVE-2007-1660)

Users of pcre are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.

Red Hat would like to thank Tavis Ormandy and Will Drewry for properly
disclosing these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bug IDs fixed (http://bugzilla.redhat.com/):

315871 - CVE-2007-1659 pcre regular expression flaws
315881 - CVE-2007-1660 pcre regular expression flaws

6. RPMs required:

Red Hat Enterprise Linux Desktop (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pcre-6.6-2.el5_0.1.src.rpm
37b0c60c16fb136bd5f47082c42a399f  pcre-6.6-2.el5_0.1.src.rpm

i386:
1e0fe12062836b8838d902f6f13005c4  pcre-6.6-2.el5_0.1.i386.rpm
0c6be04f491c5738e28ca227cd083c44  pcre-debuginfo-6.6-2.el5_0.1.i386.rpm

x86_64:
1e0fe12062836b8838d902f6f13005c4  pcre-6.6-2.el5_0.1.i386.rpm
73869b659e16a5c0c4738780b8dbf54a  pcre-6.6-2.el5_0.1.x86_64.rpm
0c6be04f491c5738e28ca227cd083c44  pcre-debuginfo-6.6-2.el5_0.1.i386.rpm
9fe6268f7f099d309a198dbc073484c5  pcre-debuginfo-6.6-2.el5_0.1.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pcre-6.6-2.el5_0.1.src.rpm
37b0c60c16fb136bd5f47082c42a399f  pcre-6.6-2.el5_0.1.src.rpm

i386:
0c6be04f491c5738e28ca227cd083c44  pcre-debuginfo-6.6-2.el5_0.1.i386.rpm
55180d96fa4e1b20fcdd580b13c94e76  pcre-devel-6.6-2.el5_0.1.i386.rpm

x86_64:
0c6be04f491c5738e28ca227cd083c44  pcre-debuginfo-6.6-2.el5_0.1.i386.rpm
9fe6268f7f099d309a198dbc073484c5  pcre-debuginfo-6.6-2.el5_0.1.x86_64.rpm
55180d96fa4e1b20fcdd580b13c94e76  pcre-devel-6.6-2.el5_0.1.i386.rpm
f60b3e0576aeee879d13906ab55519da  pcre-devel-6.6-2.el5_0.1.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/pcre-6.6-2.el5_0.1.src.rpm
37b0c60c16fb136bd5f47082c42a399f  pcre-6.6-2.el5_0.1.src.rpm

i386:
1e0fe12062836b8838d902f6f13005c4  pcre-6.6-2.el5_0.1.i386.rpm
0c6be04f491c5738e28ca227cd083c44  pcre-debuginfo-6.6-2.el5_0.1.i386.rpm
55180d96fa4e1b20fcdd580b13c94e76  pcre-devel-6.6-2.el5_0.1.i386.rpm

ia64:
ef36cfa42ba674ffe2c7201dfb112b59  pcre-6.6-2.el5_0.1.ia64.rpm
64e720230c68a59e962a7bd990c75ccb  pcre-debuginfo-6.6-2.el5_0.1.ia64.rpm
f0a778987dd0c57bcfe3e763b6395ea7  pcre-devel-6.6-2.el5_0.1.ia64.rpm

ppc:
a25c490d1f71d860ad5eb772046dbed0  pcre-6.6-2.el5_0.1.ppc.rpm
ed682d10ccf7b2482c7039d14f0df04b  pcre-6.6-2.el5_0.1.ppc64.rpm
5f66a6d45be57f9207583c3b9e2c554d  pcre-debuginfo-6.6-2.el5_0.1.ppc.rpm
b53659c8438861bbf715099f22483866  pcre-debuginfo-6.6-2.el5_0.1.ppc64.rpm
967f41898c49b310dcf607729dafff69  pcre-devel-6.6-2.el5_0.1.ppc.rpm
822c7a5c264314d84e70e41353dec898  pcre-devel-6.6-2.el5_0.1.ppc64.rpm

s390x:
6190ac263d58d9160457be33764c0bc4  pcre-6.6-2.el5_0.1.s390.rpm
a41b40a90da5af04c9ed0a713c7b0ee1  pcre-6.6-2.el5_0.1.s390x.rpm
b90a30e868ad358a65d56f151efe590c  pcre-debuginfo-6.6-2.el5_0.1.s390.rpm
b43a4377d755027344bc84fa24b9de54  pcre-debuginfo-6.6-2.el5_0.1.s390x.rpm
f39f311df66ee2a124b7d1ccc482ad08  pcre-devel-6.6-2.el5_0.1.s390.rpm
600e150dfa622a3ca5737223cfbe3eed  pcre-devel-6.6-2.el5_0.1.s390x.rpm

x86_64:
1e0fe12062836b8838d902f6f13005c4  pcre-6.6-2.el5_0.1.i386.rpm
73869b659e16a5c0c4738780b8dbf54a  pcre-6.6-2.el5_0.1.x86_64.rpm
0c6be04f491c5738e28ca227cd083c44  pcre-debuginfo-6.6-2.el5_0.1.i386.rpm
9fe6268f7f099d309a198dbc073484c5  pcre-debuginfo-6.6-2.el5_0.1.x86_64.rpm
55180d96fa4e1b20fcdd580b13c94e76  pcre-devel-6.6-2.el5_0.1.i386.rpm
f60b3e0576aeee879d13906ab55519da  pcre-devel-6.6-2.el5_0.1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1659
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1660
http://www.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is .  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
State-of-the-art spear phishing and defenses
Linux kernel source code repositories get better security
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.