{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "Skip the libtoolize/autoreconf step in %prep on el6 only. pcre2 10.48 raised\n AC_PREREQ to 2.69 and el6 ships an older autoconf, so %prep died with\n \"Autoconf version 2.69 or higher is required\" before anything was compiled -\n which is why el6 was left on 10.34-2 while el7 and el8 moved to 10.48-1.\n Nothing we patch needs the build system regenerated:\n pcre2-10.10-Fix-multilib.patch only edits pcre2-config.in, which is in\n AC_CONFIG_FILES of the shipped configure and is expanded by config.status.\n Verified that the shipped ./configure alone, with the multilib patch applied,\n emits pcre2-config with empty libR and libS and no -L@libdir@. Every other\n platform keeps regenerating exactly as before.", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293", "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_common/el6/advisories/2026/clsa-2026_1789719293.json" } ], "tracking": { "current_release_date": "2026-09-18T08:16:09Z", "generator": { "date": "2026-09-18T08:16:09Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1789719293", "initial_release_date": "2026-09-18T08:16:09Z", "revision_history": [ { "date": "2026-09-18T08:16:09Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "alt-pcre2: Fix of 6 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 6", "product": { "name": "Community Enterprise Operating System 6", "product_id": "CentOS-6", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-pcre2-utf16-0:10.48-2.el6.x86_64", "product": { "name": "alt-pcre2-utf16-0:10.48-2.el6.x86_64", "product_id": "alt-pcre2-utf16-0:10.48-2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-pcre2-utf16@10.48-2.el6?arch=x86_64&os_name=centos&os_version=6" } } }, { "category": "product_version", "name": "alt-pcre2-utf32-0:10.48-2.el6.x86_64", "product": { "name": "alt-pcre2-utf32-0:10.48-2.el6.x86_64", "product_id": "alt-pcre2-utf32-0:10.48-2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-pcre2-utf32@10.48-2.el6?arch=x86_64&os_name=centos&os_version=6" } } }, { "category": "product_version", "name": "alt-pcre2-devel-0:10.48-2.el6.x86_64", "product": { "name": "alt-pcre2-devel-0:10.48-2.el6.x86_64", "product_id": "alt-pcre2-devel-0:10.48-2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-pcre2-devel@10.48-2.el6?arch=x86_64&os_name=centos&os_version=6" } } }, { "category": "product_version", "name": "alt-pcre2-tools-0:10.48-2.el6.x86_64", "product": { "name": "alt-pcre2-tools-0:10.48-2.el6.x86_64", "product_id": "alt-pcre2-tools-0:10.48-2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-pcre2-tools@10.48-2.el6?arch=x86_64&os_name=centos&os_version=6" } } }, { "category": "product_version", "name": "alt-pcre2-static-0:10.48-2.el6.x86_64", "product": { "name": "alt-pcre2-static-0:10.48-2.el6.x86_64", "product_id": "alt-pcre2-static-0:10.48-2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-pcre2-static@10.48-2.el6?arch=x86_64&os_name=centos&os_version=6" } } }, { "category": "product_version", "name": "alt-pcre2-0:10.48-2.el6.x86_64", "product": { "name": "alt-pcre2-0:10.48-2.el6.x86_64", "product_id": "alt-pcre2-0:10.48-2.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-pcre2@10.48-2.el6?arch=x86_64&os_name=centos&os_version=6" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-pcre2-utf16-0:10.48-2.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-pcre2-utf16-0:10.48-2.el6.x86_64" }, "product_reference": "alt-pcre2-utf16-0:10.48-2.el6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-pcre2-utf32-0:10.48-2.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-pcre2-utf32-0:10.48-2.el6.x86_64" }, "product_reference": "alt-pcre2-utf32-0:10.48-2.el6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-pcre2-devel-0:10.48-2.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-pcre2-devel-0:10.48-2.el6.x86_64" }, "product_reference": "alt-pcre2-devel-0:10.48-2.el6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-pcre2-tools-0:10.48-2.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-pcre2-tools-0:10.48-2.el6.x86_64" }, "product_reference": "alt-pcre2-tools-0:10.48-2.el6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-pcre2-static-0:10.48-2.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-pcre2-static-0:10.48-2.el6.x86_64" }, "product_reference": "alt-pcre2-static-0:10.48-2.el6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-pcre2-0:10.48-2.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-pcre2-0:10.48-2.el6.x86_64" }, "product_reference": "alt-pcre2-0:10.48-2.el6.x86_64", "relates_to_product_reference": "CentOS-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-89158", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-pcre2-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-devel-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-static-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-tools-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf16-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf32-0:10.48-2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-89158" }, { "category": "external", "summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "category": "external", "summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859", "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859" } ], "release_date": "2026-09-11T04:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T08:14:55.701217Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293", "product_ids": [ "CentOS-6:alt-pcre2-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-devel-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-static-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-tools-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf16-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf32-0:10.48-2.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2022-1586", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-pcre2-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-devel-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-static-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-tools-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf16-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf32-0:10.48-2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2022-1586" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2077976%2C", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2077976%2C" }, { "category": "external", "summary": "https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a%2C", "url": "https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a%2C" }, { "category": "external", "summary": "https://github.com/PCRE2Project/pcre2/commit/d4fa336fbcc388f89095b184ba6d99422cfc676c", "url": "https://github.com/PCRE2Project/pcre2/commit/d4fa336fbcc388f89095b184ba6d99422cfc676c" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html", "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221028-0009/", "url": "https://security.netapp.com/advisory/ntap-20221028-0009/" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2077976", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2077976" }, { "category": "external", "summary": "https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a", "url": "https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a" } ], "release_date": "2022-05-16T21:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T08:14:55.701217Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293", "product_ids": [ "CentOS-6:alt-pcre2-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-devel-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-static-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-tools-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf16-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf32-0:10.48-2.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89157", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-pcre2-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-devel-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-static-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-tools-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf16-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf32-0:10.48-2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-89157" }, { "category": "external", "summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "category": "external", "summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9" } ], "release_date": "2026-09-11T04:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T08:14:55.701217Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293", "product_ids": [ "CentOS-6:alt-pcre2-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-devel-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-static-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-tools-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf16-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf32-0:10.48-2.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-1587", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-pcre2-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-devel-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-static-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-tools-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf16-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf32-0:10.48-2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2022-1587" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2077983%2C", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2077983%2C" }, { "category": "external", "summary": "https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0", "url": "https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html", "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221028-0009/", "url": "https://security.netapp.com/advisory/ntap-20221028-0009/" } ], "release_date": "2022-05-16T21:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T08:14:55.701217Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293", "product_ids": [ "CentOS-6:alt-pcre2-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-devel-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-static-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-tools-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf16-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf32-0:10.48-2.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2022-41409", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-pcre2-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-devel-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-static-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-tools-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf16-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf32-0:10.48-2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2022-41409" }, { "category": "external", "summary": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35", "url": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35" }, { "category": "external", "summary": "https://github.com/PCRE2Project/pcre2/issues/141", "url": "https://github.com/PCRE2Project/pcre2/issues/141" } ], "release_date": "2023-07-18T14:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T08:14:55.701217Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293", "product_ids": [ "CentOS-6:alt-pcre2-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-devel-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-static-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-tools-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf16-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf32-0:10.48-2.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2019-20454", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \\X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-pcre2-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-devel-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-static-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-tools-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf16-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf32-0:10.48-2.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2019-20454" }, { "category": "external", "summary": "https://bugs.exim.org/show_bug.cgi?id=2421", "url": "https://bugs.exim.org/show_bug.cgi?id=2421" }, { "category": "external", "summary": "https://bugs.php.net/bug.php?id=78338", "url": "https://bugs.php.net/bug.php?id=78338" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=1735494", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735494" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html", "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQRAHYHLRNMBTPR3KXVM27NSZP3KTOPI/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQRAHYHLRNMBTPR3KXVM27NSZP3KTOPI/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202006-16", "url": "https://security.gentoo.org/glsa/202006-16" }, { "category": "external", "summary": "https://vcs.pcre.org/pcre2?view=revision&revision=1092", "url": "https://vcs.pcre.org/pcre2?view=revision&revision=1092" } ], "release_date": "2020-02-14T14:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-18T08:14:55.701217Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293", "product_ids": [ "CentOS-6:alt-pcre2-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-devel-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-static-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-tools-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf16-0:10.48-2.el6.x86_64", "CentOS-6:alt-pcre2-utf32-0:10.48-2.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789719293" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }