Integer Overflow Vulnerability in PCRE Library Affecting Gnumeric and Goffice Packages
Summary
DEBIAN-CVE-2005-2491: Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier value... Affects gnumeric versions < 1.5.1-1. Fixed in 1.5.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gnumeric is a spreadsheet application that is part of the GNOME desktop environment, providing users with powerful data analysis and visualization tools. Goffice is a library that provides common functionality for GNOME applications. Both packages rely on the PCRE (Perl Compatible Regular Expressions) library for regex operations. The vulnerability in question arises from an integer overflow in the PCRE library, which can lead to severe security risks, including arbitrary code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2005-2491, originates from an integer overflow in the pcre_compile.c file of the PCRE library, which is utilized by various applications, including Gnumeric and Goffice. This flaw allows attackers to exploit quantifier values in regular expressions, potentially leading to a heap-based buffer overflow. If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code on the affected system, posing significant risks to data integrity and system security.
How To Fix
Minimum fixed version
1.5.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gnumericTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using regular expressions that include quantifier values until the packages are updated. This may limit some functionalities but can help mitigate the risk of exploitation until a patch is applied.
Conclusion
The integer overflow vulnerability in the PCRE library poses significant risks to applications like Gnumeric and Goffice. It is crucial for users to update their packages to the patched versions to mitigate these risks. By staying informed and proactive, users can protect their systems from potential exploitation.
See every vulnerability recorded for gnumeric →
FAQ
CVE-2005-2491 is a vulnerability in the PCRE library that can lead to arbitrary code execution due to an integer overflow in regex processing.
The vulnerability affects the Gnumeric and Goffice packages in Debian systems.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by analyzing your manifest file.
If immediate updates are not possible, avoid using regex functionalities that could exploit the vulnerability as a temporary workaround.
Detailed information about CVE-2005-2491 can be found in the Debian security advisories and the official CVE database.
References
Related vulnerabilities
Recent vulnerabilities recorded for gnumeric.
