9008 2016-01-27 16:19:16 +0000 libpcre missing CVE-2015-8391 2016-02-20 00:56:57 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 2.0.2 x86 Multiple RESOLVED FIXED Medium+ normal 2.0.2 1 akuster akuster meta.mr.watcher meta.watcher --- --- Don't know oldest_to_newest 58275 0 akuster 2016-01-27 16:19:16 +0000 CVE-2015-8391 pcre: Some pathological patterns causes pcre_compile() to run for a very long time 58276 1 akuster 2016-01-27 16:28:29 +0000 I believe there is a total of 19 between jethro and fido. 58277 2 akuster 2016-01-27 16:31:38 +0000 I would like to update jethro to the latest libpcre 8.38. 58278 3 akuster 2016-01-27 16:49:16 +0000 List: CVE-2015-3210 pcre: heap buffer overflow in pcre_compile2() / compile_regex() CVE-2015-3217 pcre: stack overflow in match() CVE-2015-5073 CVE-2015-8388 pcre: Buffer overflow caused by certain patterns with an unmatched closing parenthesis CVE-2015-8380 pcre: Heap-based buffer overflow in pcre_exec CVE-2015-8381 pcre: Heap Overflow in compile_regex() CVE-2015-8383 pcre: Buffer overflow caused by repeated conditional group CVE-2015-8384 pcre: Buffer overflow caused by recursive back reference by name within certain group CVE-2015-8385 pcre: Buffer overflow caused by forward reference by name to certain group CVE-2015-8386 pcre: Buffer overflow caused by lookbehind assertion CVE-2015-8387 pcre: Integer overflow in subroutine calls CVE-2015-8389 pcre: Infinite recursion in JIT compiler when processing certain patterns CVE-2015-8390 pcre: Reading from uninitialized memory when processing certain patterns CVE-2015-8392 pcre: Buffer overflow caused by certain patterns with duplicated named groups CVE-2015-8393 pcre: Information leak when running pcgrep -q on crafted binary CVE-2015-8394 pcre: Integer overflow caused by missing check for certain conditions CVE-2015-8395 pcre: Buffer overflow caused by certain references CVE-2016-1283 pcre: Heap buffer overflow in pcre_compile2 causes DoS 58757 4 akuster 2016-02-08 23:12:25 +0000 this went is to jethro. don't know how to handle fido. package update or a boat load of patches. 59306 5 akuster 2016-02-20 00:56:57 +0000 fido fixed http://cgit.openembedded.org/openembedded-core/commit/?h=fido&id=3bbd53035fb62793f1e44b24b18eb275bd860ed1