Vulnerability Report

CVE-2006-7228

RCE

Title: Pcre RCE

RCE

Proof Of Concept

No public PoC currently indexed for CVE-2006-7228.

CWE Category CWE-189

Published Date Nov 14, 2007

Modified Date Apr 09, 2025

Exploit Status Not Found

Score 6.8 CVSS v2.0

Exploit Probability (EPSS)

3.66%

Vulnerability Summary

CVE-2006-7228: Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 might allow context-dependent attackers to execute arbitrary code via a regular expression that involves large (1) min, (2) max, or (3) duplength values that cause an incorrect length calculation and trigger a buffer overflow, a different vulnerability than CVE-2006-7227. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.

Impacted Vendors

pcre 1

perl 1

Reference Links

http://bugs.gentoo.org/show_bug.cgi?id=198976 http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html http://lists.vmware.com/pipermail/security-announce/2008/000005.html http://lists.vmware.com/pipermail/security-announce/2008/000014.html http://scary.beasts.org/security/CESA-2007-006.html http://secunia.com/advisories/27582 http://secunia.com/advisories/27741 http://secunia.com/advisories/27773 http://secunia.com/advisories/27776 http://secunia.com/advisories/28027 http://secunia.com/advisories/28041 http://secunia.com/advisories/28050 http://secunia.com/advisories/28406 http://secunia.com/advisories/28414 http://secunia.com/advisories/28658 http://secunia.com/advisories/28714 http://secunia.com/advisories/28720 http://secunia.com/advisories/29032 http://secunia.com/advisories/29085 http://secunia.com/advisories/29785 http://secunia.com/advisories/30106 http://secunia.com/advisories/30155 http://secunia.com/advisories/30219 http://secunia.com/advisories/31124 http://security.gentoo.org/glsa/glsa-200711-30.xml http://security.gentoo.org/glsa/glsa-200801-02.xml http://security.gentoo.org/glsa/glsa-200801-18.xml http://security.gentoo.org/glsa/glsa-200801-19.xml http://security.gentoo.org/glsa/glsa-200802-10.xml http://security.gentoo.org/glsa/glsa-200805-11.xml http://support.avaya.com/elmodocs2/security/ASA-2007-505.htm http://www.debian.org/security/2008/dsa-1570 http://www.mandriva.com/security/advisories?name=MDVSA-2008:012 http://www.mandriva.com/security/advisories?name=MDVSA-2008:030 http://www.novell.com/linux/security/advisories/2007_62_pcre.html http://www.pcre.org/changelog.txt http://www.redhat.com/support/errata/RHSA-2007-1059.html http://www.redhat.com/support/errata/RHSA-2007-1063.html http://www.redhat.com/support/errata/RHSA-2007-1065.html http://www.redhat.com/support/errata/RHSA-2007-1068.html http://www.redhat.com/support/errata/RHSA-2007-1076.html http://www.redhat.com/support/errata/RHSA-2007-1077.html http://www.redhat.com/support/errata/RHSA-2008-0546.html http://www.securityfocus.com/archive/1/488457/100/0/threaded http://www.securityfocus.com/archive/1/490917/100/0/threaded http://www.securityfocus.com/bid/26462 http://www.vupen.com/english/advisories/2008/0637 http://www.vupen.com/english/advisories/2008/1234/references https://bugzilla.redhat.com/show_bug.cgi?id=383371 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10810 http://bugs.gentoo.org/show_bug.cgi?id=198976 http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html http://lists.vmware.com/pipermail/security-announce/2008/000005.html http://lists.vmware.com/pipermail/security-announce/2008/000014.html http://scary.beasts.org/security/CESA-2007-006.html http://secunia.com/advisories/27582 http://secunia.com/advisories/27741 http://secunia.com/advisories/27773 http://secunia.com/advisories/27776 http://secunia.com/advisories/28027 http://secunia.com/advisories/28041 http://secunia.com/advisories/28050 http://secunia.com/advisories/28406 http://secunia.com/advisories/28414 http://secunia.com/advisories/28658 http://secunia.com/advisories/28714 http://secunia.com/advisories/28720 http://secunia.com/advisories/29032 http://secunia.com/advisories/29085 http://secunia.com/advisories/29785 http://secunia.com/advisories/30106 http://secunia.com/advisories/30155 http://secunia.com/advisories/30219 http://secunia.com/advisories/31124 http://security.gentoo.org/glsa/glsa-200711-30.xml http://security.gentoo.org/glsa/glsa-200801-02.xml http://security.gentoo.org/glsa/glsa-200801-18.xml http://security.gentoo.org/glsa/glsa-200801-19.xml http://security.gentoo.org/glsa/glsa-200802-10.xml http://security.gentoo.org/glsa/glsa-200805-11.xml http://support.avaya.com/elmodocs2/security/ASA-2007-505.htm http://www.debian.org/security/2008/dsa-1570 http://www.mandriva.com/security/advisories?name=MDVSA-2008:012 http://www.mandriva.com/security/advisories?name=MDVSA-2008:030 http://www.novell.com/linux/security/advisories/2007_62_pcre.html http://www.pcre.org/changelog.txt http://www.redhat.com/support/errata/RHSA-2007-1059.html http://www.redhat.com/support/errata/RHSA-2007-1063.html http://www.redhat.com/support/errata/RHSA-2007-1065.html http://www.redhat.com/support/errata/RHSA-2007-1068.html http://www.redhat.com/support/errata/RHSA-2007-1076.html http://www.redhat.com/support/errata/RHSA-2007-1077.html http://www.redhat.com/support/errata/RHSA-2008-0546.html http://www.securityfocus.com/archive/1/488457/100/0/threaded http://www.securityfocus.com/archive/1/490917/100/0/threaded http://www.securityfocus.com/bid/26462 http://www.vupen.com/english/advisories/2008/0637 http://www.vupen.com/english/advisories/2008/1234/references https://bugzilla.redhat.com/show_bug.cgi?id=383371 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10810

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

6.8

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2006-7228 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

April 09, 2025 MODIFIED

Vulnerability data or affected products updated.

November 14, 2007 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected Stack

No specific products linked.