CVE-2019-20838CWE-125

CVE-2019-20838

High · published June 15, 2020

CVSS v3.1
7.5
EPSS
3%
Percentile
86.2
In the wild
Unconfirmed
What it is

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02770 · 86.2th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2020-06-15T21:15Z
Affected products (5)
ProductVersionsFixed in
pcre/pcre< 8.438.43
apple/macos< 11.0.111.0.1
splunk/universal_forwarder≥ 8.2.0, < 8.2.128.2.12
splunk/universal_forwarder≥ 9.0.0, < 9.0.69.0.6
splunk/universal_forwarderall versions—
References (14)
http://seclists.org/fulldisclosure/2020/Dec/32 · [email protected]http://seclists.org/fulldisclosure/2021/Feb/14 · [email protected]https://bugs.gentoo.org/717920 · [email protected]https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E · [email protected]https://support.apple.com/kb/HT211931 · [email protected]https://support.apple.com/kb/HT212147 · [email protected]https://www.pcre.org/original/changelog.txt · [email protected]http://seclists.org/fulldisclosure/2020/Dec/32 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2021/Feb/14 · af854a3a-2127-422b-91ae-364da2661108https://bugs.gentoo.org/717920 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT211931 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT212147 · af854a3a-2127-422b-91ae-364da2661108https://www.pcre.org/original/changelog.txt · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 15 JUN 16:50Z
    libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to…
    cvelistv5