NetSight
IP …
high7.5

CVE-2019-20454

An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode.

Impact

An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.

Affected products

VendorProductAffected versions
PcrePcre2
from 10.31 before 10.34
FedoraprojectFedora
Version 31
SplunkUniversal Forwarder
from 8.2.0 before 8.2.12
from 9.0.0 before 9.0.6
Version 9.1.0

Weakness classification

CWE-125

References