vulnwire
4.0med

CVE-2007-4772

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 b…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
4.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.8%
percentile 90%
Public exploits
0
none known

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted regular expression.

Exploit prediction (EPSS)

3.81% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.04.0AV:N/AC:L/Au:S/C:N/I:N/A:P

Classification

Weakness
Technology feeds
PostgreSQL (RSS, critical only)

References

  • lists.opensuse.org /opensuse-security-announce/2016-02/msg00054.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • redhat.com /support/errata/RHSA-2008-0134.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • mandriva.com /security/advisories?name=MDVSA-2008:004 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • debian.org /security/2008/dsa-1460 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • vupen.com /english/advisories/2008/1744 · vdb-entry, x_refsource_VUPEN, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-03/msg00016.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-02/msg00052.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • rhn.redhat.com /errata/RHSA-2013-0122.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securityfocus.com /bid/27163 · vdb-entry, x_refsource_BID, x_transferred
  • issues.rpath.com /browse/RPL-1768 · x_refsource_CONFIRM, x_transferred
  • redhat.com /support/errata/RHSA-2008-0038.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • secunia.com /advisories/28454 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/485864/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/28359 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • postgresql.org /about/news.905 · x_refsource_CONFIRM, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2008-02/msg00000.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • vupen.com /english/advisories/2008/0061 · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/28679 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2008/0109 · vdb-entry, x_refsource_VUPEN, x_transferred
  • vmware.com /security/advisories/VMSA-2008-0009.html · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/28376 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • sourceforge.net /tracker/index.php?func=detail&aid=1810264&group_id=10894&atid=110894 · x_refsource_CONFIRM, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-26-103197-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • secunia.com /advisories/28437 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/28455 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/28477 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/29638 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/28479 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • sourceforge.net /project/shownotes.php?release_id=565440&group_id=10894 · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/29248 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/39497 · vdb-entry, x_refsource_XF, x_transferred
  • debian.org /security/2008/dsa-1463 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • redhat.com /support/errata/RHSA-2008-0040.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-02/msg00056.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • securityfocus.com /archive/1/486407/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • mandriva.com /security/advisories?name=MDVSA-2008:059 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • secunia.com /advisories/28464 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/30535 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/28698 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • h20000.www2.hp.com /bizsupport/TechSupport/Document.jsp?objectID=c01420154 · vendor-advisory, x_refsource_HP, x_transferred
  • kb.juniper.net /InfoCenter/index?page=content&id=JSA10705 · Third Party Advisory
  • lists.opensuse.org /opensuse-security-announce/2016-02/msg00049.html · Mailing List, Third Party Advisory
  • secunia.com /advisories/28438 · Third Party Advisory
  • secunia.com /advisories/29070 · Third Party Advisory
  • security.gentoo.org /glsa/glsa-200801-15.xml · Third Party Advisory
  • securitytracker.com /id?1019157 · Third Party Advisory, VDB Entry
  • sunsolve.sun.com /search/document.do?assetkey=1-66-200559-1 · Broken Link

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.