CVE-2025-58050
pcre2: PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (moyenne), Julia (moyenne), Ubuntu (moyenne).
Description
The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable by the attacker. This issue has been resolved in version 10.46.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.22 | pcre2 | 10.46-r0 |
| alpine 3.23 | pcre2 | 10.46-r0 |
| alpine 3.24 | pcre2 | 10.46-r0 |
| alpine edge | pcre2 | 10.46-r0 |
| debian 13 | pcre2 | 10.46-1~deb13u1 |
| debian 14 | pcre2 | 10.46-1 |
| julia::Julia Ecosystem Security Advisories | PCRE2_jll | 10.46.0+0 |
| minimos | pcre2 | 10.46-r0 |
| rapidfort alpine 3.20 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.21 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.22 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.23 | pcre2 | 10.46-r0 |
Afficher les 20 entrées de 17 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.22 | pcre2 | 10.46-r0 |
| alpine 3.23 | pcre2 | 10.46-r0 |
| alpine 3.24 | pcre2 | 10.46-r0 |
| alpine edge | pcre2 | 10.46-r0 |
| debian 13 | pcre2 | 10.46-1~deb13u1 |
| debian 14 | pcre2 | 10.46-1 |
| julia::Julia Ecosystem Security Advisories | PCRE2_jll | 10.46.0+0 |
| minimos | pcre2 | 10.46-r0 |
| rapidfort alpine 3.20 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.21 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.22 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.23 | pcre2 | 10.46-r0 |
| rapidfort alpine 3.24 | pcre2 | 10.46-r0 |
| rapidfort debian 12 | pcre2 | 0:10.46-1, 0:10.46-1~deb13u1 |
| rapidfort debian 12 | rf-pcre2 | 0:10.46-1~deb13u1 |
| rapidfort debian 13 | pcre2 | 0:10.46-1, 0:10.46-1~deb13u1 |
| rapidfort debian 13 | rf-pcre2 | 0:10.46-1~deb13u1 |
| root.io ubuntu 22.04 | pcre2 | 10.39-3ubuntu0.1.root.io.1, 10.39-3ubuntu0.1.root.io.2, 10.39-3ubuntu0.1.root.io.3, 10.39-3ubuntu0.1.root.io.4 |
| root.io ubuntu 22.04 | rootio-pcre2 | 10.39-3ubuntu0.1.root.io.1, 10.39-3ubuntu0.1.root.io.2, 10.39-3ubuntu0.1.root.io.3, 10.39-3ubuntu0.1.root.io.4 |
| ubuntu 25.04 | pcre2 | 10.45-1ubuntu0.1 |
Références
- https://access.redhat.com/security/cve/CVE-2025-58050
- https://github.com/PCRE2Project/pcre2/commit/a141712e5967d448c7ce13090ab530c8e3d82254
- https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.46
- https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-c2gv-xgf5-5cc2
- https://nvd.nist.gov/vuln/detail/CVE-2025-58050
- https://ubuntu.com/security/notices/USN-7777-1
- https://www.cve.org/CVERecord?id=CVE-2025-58050