CVE-2008-1026 : Integer overflow in the PCRE regular expression compiler (JavaScriptCore/pcre/pc

Integer overflow in the PCRE regular expression compiler (JavaScriptCore/pcre/pcre_compile.cpp) in Apple WebKit, as used in Safari before 3.1.1, allows remote attackers to execute arbitrary code via a regular expression with large, nested repetition counts, which triggers a heap-based buffer overflow.

Published 2008-04-17 19:05:00

Updated 2018-10-11 20:29:07

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Products affected by CVE-2008-1026

Apple » Safari » Version: 3
cpe:2.3:a:apple:safari:3:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X » Version: 10.4.11
When used together with: Apple » Mac Os X » Version: 10.5.2
When used together with: Apple » Mac Os X Server » Version: 10.4.11
When used together with: Apple » Mac Os X Server » Version: 10.5.2
When used together with: Microsoft » Windows Vista
When used together with: Microsoft » Windows Xp
Apple » Safari » Version: 3.1
cpe:2.3:a:apple:safari:3.1:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X » Version: 10.4.11
When used together with: Apple » Mac Os X » Version: 10.5.2
When used together with: Apple » Mac Os X Server » Version: 10.4.11
When used together with: Apple » Mac Os X Server » Version: 10.5.2
When used together with: Microsoft » Windows Vista
When used together with: Microsoft » Windows Xp

Exploit prediction scoring system (EPSS) score for CVE-2008-1026

EPSS FAQ

14.86%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 96 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-1026

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2008-1026

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

Vendor statements for CVE-2008-1026

Red Hat 2008-04-24

Not vulnerable. This issue did not affect versions of pcre as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.

References for CVE-2008-1026