CVE-2007-4767

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-11-07 · updated 2026-06-16

Description

Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length of (1) a \p sequence, (2) a \P sequence, or (3) a \P{x} sequence, which allows context-dependent attackers to cause a denial of service (infinite loop or crash) or execute arbitrary code.

Affected products

Pcre: through 6.0; through 6.1; through 7.3

References

http://bugs.gentoo.org/show_bug.cgi?id=198976
http://docs.info.apple.com/article.html?artnum=307179
http://docs.info.apple.com/article.html?artnum=307562
http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
http://mail.gnome.org/archives/gtk-devel-list/2007-November/msg00022.html
http://secunia.com/advisories/27538
http://secunia.com/advisories/27543
http://secunia.com/advisories/27554
http://secunia.com/advisories/27697
http://secunia.com/advisories/27741
http://secunia.com/advisories/27773

Get alerted when CVE-2007-4767 or the next vulnerability affects your stack