CVE-2017-6004

Name	CVE-2017-6004
Description	The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium
Debian Bugs	855405

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pcre3 (PTS)	stretch	2:8.39-3	fixed
	buster	2:8.39-12	fixed
	bookworm, sid, bullseye	2:8.39-13	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
pcre3	source	wheezy	(not affected)
pcre3	source	jessie	(not affected)
pcre3	source	(unstable)	2:8.39-2.1	855405

Notes

[jessie] - pcre3 <not-affected> (Vulnerable code introduced later)
[wheezy] - pcre3 <not-affected> (Vulnerable code introduced later)
https://vcs.pcre.org/pcre/code/trunk/pcre_jit_compile.c?r1=1676&r2=1680&view=patch
https://bugs.exim.org/show_bug.cgi?id=2035