CVE-2025-58050
pcre2: PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Julia (media), Ubuntu (media).
Descripción
The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable by the attacker. This issue has been resolved in version 10.46.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.22 | pcre2 | 10.46-r0 |
| alpine 3.23 | pcre2 | 10.46-r0 |
| alpine 3.24 | pcre2 | 10.46-r0 |
| alpine edge | pcre2 | 10.46-r0 |
| debian 13 | pcre2 | 10.46-1~deb13u1 |
| debian 14 | pcre2 | 10.46-1 |
| julia::Julia Ecosystem Security Advisories | PCRE2_jll | 10.46.0+0 |
| minimos | pcre2 | 10.46-r0 |
| rapidfort alpine 3.20 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.21 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.22 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.23 | pcre2 | 10.46-r0 |
Mostrar las 20 entradas de 17 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.22 | pcre2 | 10.46-r0 |
| alpine 3.23 | pcre2 | 10.46-r0 |
| alpine 3.24 | pcre2 | 10.46-r0 |
| alpine edge | pcre2 | 10.46-r0 |
| debian 13 | pcre2 | 10.46-1~deb13u1 |
| debian 14 | pcre2 | 10.46-1 |
| julia::Julia Ecosystem Security Advisories | PCRE2_jll | 10.46.0+0 |
| minimos | pcre2 | 10.46-r0 |
| rapidfort alpine 3.20 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.21 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.22 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.23 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.24 | pcre2 | 10.46-r0 |
| rapidfort debian 12 | pcre2 | 0:10.46-1, 0:10.46-1~deb13u1 |
| rapidfort debian 12 | rf-pcre2 | 0:10.46-1~deb13u1 |
| rapidfort debian 13 | pcre2 | 0:10.46-1, 0:10.46-1~deb13u1 |
| rapidfort debian 13 | rf-pcre2 | 0:10.46-1~deb13u1 |
| root.io ubuntu 22.04 | pcre2 | 10.39-3ubuntu0.1.root.io.1, 10.39-3ubuntu0.1.root.io.2, 10.39-3ubuntu0.1.root.io.3, 10.39-3ubuntu0.1.root.io.4 |
| root.io ubuntu 22.04 | rootio-pcre2 | 10.39-3ubuntu0.1.root.io.1, 10.39-3ubuntu0.1.root.io.2, 10.39-3ubuntu0.1.root.io.3, 10.39-3ubuntu0.1.root.io.4 |
| ubuntu 25.04 | pcre2 | 10.45-1ubuntu0.1 |
Referencias
- https://access.redhat.com/security/cve/CVE-2025-58050
- https://github.com/PCRE2Project/pcre2/commit/a141712e5967d448c7ce13090ab530c8e3d82254
- https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.46
- https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-c2gv-xgf5-5cc2
- https://nvd.nist.gov/vuln/detail/CVE-2025-58050
- https://ubuntu.com/security/notices/USN-7777-1
- https://www.cve.org/CVERecord?id=CVE-2025-58050