Source: pcre2 Version: 10.48-3 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
From https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m: | A regular expression can cause JIT-compiled matching to write outside | the maximum memory area of a growable JIT stack. A sufficiently large | single stack allocation may exceed the fixed amount by which the stack | is grown, allowing subsequent writes below the allocated region. | | An attacker must be able to supply a regular expression that is JIT | compiled and matched by an application using a growable JIT stack. | Patterns with very large numbers of capturing groups can trigger | the issue. Regards, Salvatore
