CVE-2014-9769

Name	CVE-2014-9769
Description	pcre_jit_compile.c in PCRE 8.35 does not properly use table jumps to optimize nested alternatives, which allows remote attackers to cause a denial of service (stack memory corruption) or possibly have unspecified other impact via a crafted string, as demonstrated by packets encountered by Suricata during use of a regular expression in an Emerging Threats Open ruleset.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	819050

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pcre3 (PTS)	buster	2:8.39-12	fixed
	bullseye	2:8.39-13	fixed
	trixie, sid, bookworm	2:8.39-15	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
pcre3	source	wheezy	(not affected)
pcre3	source	jessie	2:8.35-3.3+deb8u4
pcre3	source	(unstable)	2:8.38-1	819050

Notes

[wheezy] - pcre3 <not-affected> (Vulnerable code not present)
Upstream fix: http://vcs.pcre.org/pcre?view=revision&revision=1475 (8.36)
Introduced in: http://vcs.pcre.org/pcre?view=revision&revision=1434 (8.35)
https://www.openwall.com/lists/oss-security/2016/03/26/1