CPANSA-Alien-PCRE2.yml

---
- affected_versions: '<0.016000'
  cves:
    - CVE-2019-20454
  description: >
    An out-of-bounds read was discovered in PCRE before 10.34 when
    the pattern \X is JIT compiled and used to match specially crafted
    subjects in non-UTF mode. Applications that use PCRE to parse
    untrusted input may be vulnerable to this flaw, which would allow an
    attacker to crash the application. The flaw occurs in do_extuni_no_utf
    in pcre2_jit_compile.c.
  comment: >
    This Alien module fetches libpcre2 sources from the network. It tries
    to get the latest unless you set environment variables to get a
    different version.
  distribution: Alien-PCRE2
  fixed_versions: '>=0.016000'
  id: CPANSA-Alien-PCRE2-2019-20454
  references:
    - https://bugs.php.net/bug.php?id=78338
    - https://bugs.exim.org/show_bug.cgi?id=2421
    - https://bugzilla.redhat.com/show_bug.cgi?id=1735494
    - https://vcs.pcre.org/pcre2?view=revision&revision=1092
    - https://security.gentoo.org/glsa/202006-16
    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQRAHYHLRNMBTPR3KXVM27NSZP3KTOPI/
  reported: 2020-02-14
  severity: high