CVE-2019-20454 — Vulnerability intelligence

pcre — pcre2

Published: 2020-02-14T00:00:00.000Z

CVSS

5.1

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.

Sources

• CVE-2019-20454
• Issue Tracking, Permissions Required, Third Party Advisory
• Exploit, Issue Tracking, Third Party Advisory
• Issue Tracking, Patch, Third Party Advisory
• Mailing List, Third Party Advisory
• Mailing List, Third Party Advisory
• Third Party Advisory
• Broken Link, Patch
• CVE-2019-20454