Your submission was sent successfully! Close

CVE-2007-4772

Published: 09 January 2008

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted regular expression.

Priority

Low

Status

Package Release Status
postgresql-8.1
Launchpad, Ubuntu, Debian
Upstream Needs triage

postgresql-8.2
Launchpad, Ubuntu, Debian
Upstream Needs triage

tcl8.3
Launchpad, Ubuntu, Debian
Upstream Needs triage

Patches:
Vendor: https://rhn.redhat.com/errata/RHSA-2008-0134.html
tcl8.4
Launchpad, Ubuntu, Debian
Upstream Not vulnerable
(8.4.17)
Patches:
Upstream: http://tcl.cvs.sourceforge.net/tcl/tcl/generic/regc_nfa.c?r1=1.9&r2=1.10
Upstream: http://tcl.cvs.sourceforge.net/viewvc/tcl/tcl/tests/regexp.test?r1=1.22.2.3&r2=1.22.2.4
tcl8.5
Launchpad, Ubuntu, Debian
Upstream Not vulnerable
(8.5.1)