CVE-2008-2371

Name: CVE-2008-2371
Creator: NVD / NIST
Published: 2008-07-07T23:41:00+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 6.73%

Last modified Jun 16, 2026

CVE-2008-2371 is a vulnerability of currently unknown severity. Heap-based buffer overflow in pcre_compile.c in the Perl-Compatible Regular Expression (PCRE) library 7.7 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a regular expression that begins with an option and contains multiple branches.. EPSS estimates a 6.73% chance of exploitation in the next 30 days.

Description

Heap-based buffer overflow in pcre_compile.c in the Perl-Compatible Regular Expression (PCRE) library 7.7 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a regular expression that begins with an option and contains multiple branches.

Metrics

EPSS Probability

6.73%

93.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-787

Affected Software

Vendor	Product	Versions
Pcre	Pcre	7.7
Php	Php	>= 5.2.0, <= 5.2.7
Debian	Debian Linux	4.0
Canonical	Ubuntu Linux	6.06
Canonical	Ubuntu Linux	7.04
Canonical	Ubuntu Linux	7.10
Canonical	Ubuntu Linux	8.04
Canonical	Ubuntu Linux	9.10
Fedoraproject	Fedora	8
Fedoraproject	Fedora	9
Opensuse	Opensuse	10.3

References

http://bugs.gentoo.org/show_bug.cgi?id=228091Exploit, Issue Tracking
http://ftp.gnome.org/pub/GNOME/sources/glib/2.16/glib-2.16.4.changesThird Party Advisory
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlMailing List
http://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlMailing List
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=124654546101607&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=125631037611762&w=2Issue Tracking, Third Party Advisory
http://secunia.com/advisories/30916Not Applicable
http://secunia.com/advisories/30944Not Applicable
http://secunia.com/advisories/30945Not Applicable
http://secunia.com/advisories/30958Not Applicable
http://secunia.com/advisories/30961Not Applicable
http://secunia.com/advisories/30967Not Applicable
http://secunia.com/advisories/30972Not Applicable
http://secunia.com/advisories/30990Not Applicable
http://secunia.com/advisories/31200Not Applicable
http://secunia.com/advisories/32222Not Applicable
http://secunia.com/advisories/32454Not Applicable
http://secunia.com/advisories/32746Not Applicable
http://secunia.com/advisories/35074Not Applicable
http://secunia.com/advisories/35650Not Applicable
http://secunia.com/advisories/39300Not Applicable
http://security.gentoo.org/glsa/glsa-200811-05.xmlThird Party Advisory
http://support.apple.com/kb/HT3216Third Party Advisory
http://support.apple.com/kb/HT3549Third Party Advisory
http://ubuntu.com/usn/usn-624-2Third Party Advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0305Broken Link, Third Party Advisory
http://www.debian.org/security/2008/dsa-1602Third Party Advisory
http://www.gentoo.org/security/en/glsa/glsa-200807-03.xmlThird Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:147Broken Link, Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:023Broken Link, Third Party Advisory
http://www.securityfocus.com/archive/1/497828/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/30087Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/31681Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/usn-624-1Third Party Advisory
http://www.ubuntu.com/usn/usn-628-1Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2008/2005Permissions Required, Third Party Advisory
http://www.vupen.com/english/advisories/2008/2006Permissions Required, Third Party Advisory
http://www.vupen.com/english/advisories/2008/2336Permissions Required, Third Party Advisory
http://www.vupen.com/english/advisories/2008/2780Permissions Required, Third Party Advisory
http://www.vupen.com/english/advisories/2009/1297Permissions Required, Third Party Advisory
http://www.vupen.com/english/advisories/2010/0833Permissions Required, Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00105.htmlThird Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00123.htmlThird Party Advisory
http://bugs.gentoo.org/show_bug.cgi?id=228091Exploit, Issue Tracking
http://ftp.gnome.org/pub/GNOME/sources/glib/2.16/glib-2.16.4.changesThird Party Advisory
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlMailing List
http://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlMailing List
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=124654546101607&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=125631037611762&w=2Issue Tracking, Third Party Advisory
http://secunia.com/advisories/30916Not Applicable
http://secunia.com/advisories/30944Not Applicable
http://secunia.com/advisories/30945Not Applicable
http://secunia.com/advisories/30958Not Applicable
http://secunia.com/advisories/30961Not Applicable
http://secunia.com/advisories/30967Not Applicable
http://secunia.com/advisories/30972Not Applicable
http://secunia.com/advisories/30990Not Applicable
http://secunia.com/advisories/31200Not Applicable
http://secunia.com/advisories/32222Not Applicable
http://secunia.com/advisories/32454Not Applicable
http://secunia.com/advisories/32746Not Applicable
http://secunia.com/advisories/35074Not Applicable
http://secunia.com/advisories/35650Not Applicable
http://secunia.com/advisories/39300Not Applicable
http://security.gentoo.org/glsa/glsa-200811-05.xmlThird Party Advisory
http://support.apple.com/kb/HT3216Third Party Advisory
http://support.apple.com/kb/HT3549Third Party Advisory
http://ubuntu.com/usn/usn-624-2Third Party Advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0305Broken Link, Third Party Advisory
http://www.debian.org/security/2008/dsa-1602Third Party Advisory
http://www.gentoo.org/security/en/glsa/glsa-200807-03.xmlThird Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:147Broken Link, Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:023Broken Link, Third Party Advisory
http://www.securityfocus.com/archive/1/497828/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/30087Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/31681Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/usn-624-1Third Party Advisory
http://www.ubuntu.com/usn/usn-628-1Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2008/2005Permissions Required, Third Party Advisory
http://www.vupen.com/english/advisories/2008/2006Permissions Required, Third Party Advisory
http://www.vupen.com/english/advisories/2008/2336Permissions Required, Third Party Advisory
http://www.vupen.com/english/advisories/2008/2780Permissions Required, Third Party Advisory
http://www.vupen.com/english/advisories/2009/1297Permissions Required, Third Party Advisory
http://www.vupen.com/english/advisories/2010/0833Permissions Required, Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00105.htmlThird Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00123.htmlThird Party Advisory

Timeline

Published: Jul 7, 2008
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2008-2371?

How severe is CVE-2008-2371?

Severity scoring for CVE-2008-2371 is pending analysis. The EPSS model estimates a 6.73% probability of exploitation in the next 30 days.

How do I fix CVE-2008-2371?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2008-2371?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST