JIT buffer overflow fixed in libpcre2-10.49
PCRE2 10.49 fixes a JIT out-of-bounds write that needs an attacker-controlled regular expression.
PCRE2 10.49 is a security-only release fixing GHSA-r9hj-j2rw-4q3m. Relative to 10.48, the change blocks an out-of-bounds write of arbitrary data in the JIT. An attacker-controlled regular expression is required, and only applications that use pcre2_jit_stack_create() and pcre2_jit_stack_assign() for a growable JIT stack are affected.
- Security-only release pcre2-10.49 addresses GHSA-r9hj-j2rw-4q3m.
- Bug is an out-of-bounds write of arbitrary data in the JIT.
- Attacker must control the regex, and the app must use a growable JIT stack.
- Vendors
- PCRE2 Project
- Organizations
- PCRE2 Project
From the original article
Posted by Sam James on Sep 28 From https://github. com/PCRE2Project/pcre2/releases/tag/pcre2-10. 49 """ This is a security-only release, to address GHSA-r9hj-j2rw-4q3m.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.