Bug 16217

Summary:	pcre new security issue CVE-2015-5073
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	davidwhodgins, sysadmin-bugs
Version:	5	Keywords:	validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/650305/
Whiteboard:	MGA5-32-OK advisory
Source RPM:	pcre-9.37-2.mga5.src.rpm	CVE:
Status comment:

Description David Walser 2015-06-26 16:29:25 CEST

A CVE has been issued for another security issue fixed upstream in PCRE:
http://openwall.com/lists/oss-security/2015/06/26/3

The upstream patch to fix it is pasted in the upstream bug:
https://bugs.exim.org/show_bug.cgi?id=1651

Mageia 4 is also affected, but more PCRE issues are being handled for that in Bug 16067.

Patched packages uploaded for Mageia 5 and Cauldron.

Note to QA: there are also PoCs in the upstream bug.

Advisory:
========================

Updated pcre packages fix security vulnerability:

PCRE library is prone to a vulnerability which leads to Heap Overflow. During
subpattern calculation of a malformed regular expression, an offset that is
used as an array index is fully controlled and can be large enough so that
unexpected heap memory regions are accessed (CVE-2015-5073).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5073
http://openwall.com/lists/oss-security/2015/06/26/3
========================

Updated packages in core/updates_testing:
========================
pcre-8.37-2.1.mga5
libpcre1-8.37-2.1.mga5
libpcre16_0-8.37-2.1.mga5
libpcre32_0-8.37-2.1.mga5
libpcrecpp0-8.37-2.1.mga5
libpcreposix1-8.37-2.1.mga5
libpcreposix0-8.37-2.1.mga5
libpcre-devel-8.37-2.1.mga5
libpcrecpp-devel-8.37-2.1.mga5
libpcreposix-devel-8.37-2.1.mga5

from pcre-8.37-2.1.mga5.src.rpm

Reproducible: 

Steps to Reproduce:

Comment 1 David Walser 2015-07-04 18:26:01 CEST

Before the update, with the attachment to https://bugs.exim.org/show_bug.cgi?id=1651 I got:
$ php poc.php
Segmentation fault

After the update I get:
$ php poc.php
PHP Warning:  preg_match(): Compilation failed: unmatched parentheses at offset 125 in /tmp/poc.php on line 2

Can anyone verify that Mageia 4 is not affected on x86_64?  I get this on i586:
$ php poc.php 
PHP Warning:  preg_match(): Compilation failed: lookbehind assertion is not fixed length at offset 125 in /tmp/poc.php on line 2

Whiteboard: (none) => MGA5-32-OK

Comment 2 Dave Hodgins 2015-07-04 19:19:37 CEST

Advisory committed to svn.

Someone from the sysadmin team please push 16217.adv to updates.

Keywords: (none) => validated_update
Whiteboard: MGA5-32-OK => MGA5-32-OK advisory
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 3 Mageia Robot 2015-07-05 19:23:44 CEST

An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0267.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

David Walser 2015-07-06 20:26:04 CEST

URL: (none) => http://lwn.net/Vulnerabilities/650305/