Integer overflow in PCRE2 - CVE-2022-41409

Vulnerability identifier: #VU79112

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-41409

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in pcre2test. A remote attacker can pass specially crafted data to the application, trigger an integer overflow and perform a denial of service (DoS) attack.

PCRE2
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Basesystem Module
openSUSE Leap
openEuler
Oracle Solaris
Telemetry Dashboard
Guardium Data Security Center (GDSC)
Oracle Business Intelligence Enterprise Edition
Liquidware
Citrix Workspace App
Webex App VDI
ObjectScale
Cloud Pak for Data System - Cyclops
Cisco Jabber
Cisco Webex Meetings
VMware Horizon Client
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM
libpcre2-32-0-debuginfo
libpcre2-16-0-debuginfo
libpcre2-16-0
libpcre2-8-0
libpcre2-32-0
pcre2-debugsource
libpcre2-posix2
libpcre2-8-0-debuginfo
pcre2-devel
libpcre2-posix2-debuginfo
pcre2-tools
pcre2-devel-static
pcre2-tools-debuginfo
pcre2
pcre2-debuginfo
pcre2-help
libpcre2-8-0-64bit-debuginfo
libpcre2-16-0-64bit
libpcre2-32-0-32bit-debuginfo
libpcre2-16-0-64bit-debuginfo
libpcre2-posix2-64bit
libpcre2-32-0-64bit-debuginfo
libpcre2-posix2-64bit-debuginfo
libpcre2-8-0-64bit
libpcre2-32-0-64bit
pcre2-doc
libpcre2-posix2-32bit-debuginfo
libpcre2-16-0-32bit-debuginfo
libpcre2-32-0-32bit
libpcre2-8-0-32bit
libpcre2-16-0-32bit
libpcre2-posix2-32bit
libpcre2-8-0-32bit-debuginfo

Install updates from vendor's website.

PCRE2 - update to 10.41
Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
Guardium Data Security Center (GDSC) - update to 3.6.1
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405
ObjectScale - update to 1.4.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.0
EMC ViPR SRM - update to 4.10.0.0
libpcre2-32-0-debuginfo - addressed in versions 10.31-150000.3.15.1, 10.34-1.13.1, 10.39-150400.4.9.1
libpcre2-16-0-debuginfo - addressed in versions 10.31-150000.3.15.1, 10.34-1.13.1, 10.39-150400.4.9.1
libpcre2-16-0 - addressed in versions 10.31-150000.3.15.1, 10.34-1.13.1, 10.39-150400.4.9.1
libpcre2-8-0 - addressed in versions 10.31-150000.3.15.1, 10.34-1.13.1, 10.39-150400.4.9.1
libpcre2-32-0 - addressed in versions 10.31-150000.3.15.1, 10.34-1.13.1, 10.39-150400.4.9.1
pcre2-debugsource - addressed in versions 10.31-150000.3.15.1, 10.34-1.13.1, 10.39-150400.4.9.1
libpcre2-posix2 - addressed in versions 10.31-150000.3.15.1, 10.34-1.13.1, 10.39-150400.4.9.1
libpcre2-8-0-debuginfo - addressed in versions 10.31-150000.3.15.1, 10.34-1.13.1, 10.39-150400.4.9.1
pcre2-devel - addressed in versions 10.31-150000.3.15.1, 10.34-1.13.1, 10.39-150400.4.9.1
libpcre2-posix2-debuginfo - addressed in versions 10.31-150000.3.15.1, 10.34-1.13.1, 10.39-150400.4.9.1
pcre2-tools - addressed in versions 10.34-1.13.1, 10.39-150400.4.9.1
pcre2-devel-static - addressed in versions 10.34-1.13.1, 10.39-150400.4.9.1
pcre2-tools-debuginfo - addressed in versions 10.34-1.13.1, 10.39-150400.4.9.1
pcre2-devel - update to 10.35-5
pcre2 - update to 10.35-5
pcre2-debuginfo - update to 10.35-5
pcre2-debugsource - update to 10.35-5
pcre2-help - update to 10.35-5
libpcre2-8-0-64bit-debuginfo - update to 10.39-150400.4.9.1
libpcre2-16-0-64bit - update to 10.39-150400.4.9.1
libpcre2-32-0-32bit-debuginfo - update to 10.39-150400.4.9.1
libpcre2-16-0-64bit-debuginfo - update to 10.39-150400.4.9.1
libpcre2-posix2-64bit - update to 10.39-150400.4.9.1
libpcre2-32-0-64bit-debuginfo - update to 10.39-150400.4.9.1
libpcre2-posix2-64bit-debuginfo - update to 10.39-150400.4.9.1
libpcre2-8-0-64bit - update to 10.39-150400.4.9.1
libpcre2-32-0-64bit - update to 10.39-150400.4.9.1
pcre2-doc - update to 10.39-150400.4.9.1
libpcre2-posix2-32bit-debuginfo - update to 10.39-150400.4.9.1
libpcre2-16-0-32bit-debuginfo - update to 10.39-150400.4.9.1
libpcre2-32-0-32bit - update to 10.39-150400.4.9.1
libpcre2-8-0-32bit - update to 10.39-150400.4.9.1
libpcre2-16-0-32bit - update to 10.39-150400.4.9.1
libpcre2-posix2-32bit - update to 10.39-150400.4.9.1
libpcre2-8-0-32bit-debuginfo - update to 10.39-150400.4.9.1
pcre2 - update to 10.40-1
Cloud Pak for Data System - Cyclops - update to 11.3.1.1
Oracle Solaris - update to 11.4 SRU 62

• https://github.com/PCRE2Project/pcre2/issues/141
• https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35

• Denial of service in PCRE2
• SUSE update for pcre2
• SUSE update for pcre2
• SUSE update for pcre2
• Oracle Solaris update for thrid-party components
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• openEuler update for pcre2
• Multiple vulnerabilities in Dell ThinOS
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in Guardium Data Security Center
• Amazon Linux AMI update for pcre2
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in IBM Cloud Pak for Data System - Cyclops