CVE-2005-2491

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-08-23 · updated 2026-06-16

Description

Integer overflow in pcre_compile.c in Perl Compatible Regular Expressions (PCRE) before 6.2, as used in multiple products such as Python, Ethereal, and PHP, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow.

Affected products

Pcre: 5.0, 6.0, 6.1

References

http://docs.info.apple.com/article.html?artnum=302847
http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522
http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html
http://marc.info/?l=bugtraq&m=112605112027335&w=2
http://marc.info/?l=bugtraq&m=112606064317223&w=2
http://marc.info/?l=bugtraq&m=130497311408250&w=2
http://secunia.com/advisories/16502
http://secunia.com/advisories/16679
http://secunia.com/advisories/17252
http://secunia.com/advisories/17813

Get alerted when CVE-2005-2491 or the next vulnerability affects your stack