CVE-2019-20838
🟡 Monitoruj
Przepełnienie bufora w libpcre umożliwia odczytanie pamięci poza granicami.
CVSS
7.5
EPSS
2.8%
Exploit
none
Vendor
splunk
Opis źródłowy (NVD)
libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.5 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 2.8% |
| Opublikowano (NVD) | 2020-06-15 17:15:09 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-08 22:16:54 UTC |
Referencje
- http://seclists.org/fulldisclosure/2020/Dec/32 ([email protected]) [Mailing List, Third Party Advisory]
- http://seclists.org/fulldisclosure/2021/Feb/14 ([email protected]) [Mailing List, Third Party Advisory]
- https://bugs.gentoo.org/717920 ([email protected]) [Issue Tracking, Patch, Third Party Advisory, VDB Entry]
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E ([email protected]) [Mailing List, Third Party Advisory]
- https://support.apple.com/kb/HT211931 ([email protected]) [Vendor Advisory]
- https://support.apple.com/kb/HT212147 ([email protected]) [Vendor Advisory]
- https://www.pcre.org/original/changelog.txt ([email protected]) [Release Notes, Vendor Advisory]