CVE-2017-13846
CriticalSummary
An issue was discovered in certain Apple products, including macOS before 10.13.1, related to the third-party 'PCRE' product. Versions before 8.40 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
Risk Assessment
Organizations may be exposed to attacks that lead to application crashes, affecting service availability. Additionally, there is a risk of unspecified impacts that could affect system security.
Recommendation
It is recommended to update to the latest version of macOS and to update the PCRE component to version 8.40 or later to minimize risk.
Other vulnerabilities in PCRE
See all- CVE-2014-9769High
PCRE 8.35 has an issue with optimizing nested alternatives, which can lead to denial of service through stack memory corruption. Remote attackers can exploit this vulnerability by sending a crafted string.
- CVE-2015-8395High
PCRE before 8.38 mishandles certain references, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8392High
PCRE before 8.38 mishandles certain instances of the (?| substring, allowing remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8388High
PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8387High
PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, allowing remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-2328High
PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2020-14155Medium
The libpcre library in PCRE before version 8.44 is vulnerable to an integer overflow. The issue occurs when a large number is used after the (?C substring in a regular expression.
- CVE-2016-1283Critical
The pcre_compile2 function in PCRE 8.38 mishandles patterns with named subgroups, potentially leading to a heap-based buffer overflow. Remote attackers can exploit this vulnerability by sending a crafted regular expression.
- CVE-2015-8394Critical
PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, allowing remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8391Critical
The pcre_compile function in PCRE before 8.38 mishandles certain [: nesting, which can lead to denial of service (CPU consumption) or other unspecified impacts via a crafted regular expression.
Original NVD description (English source)
An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the third-party "PCRE" product. Versions before 8.40 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.