CVE:CVE-2008-2371
CNNVD:CNNVD-200807-093
PCRE是Philip Hazel个人开发者的一款使用C语言编写的开源正则表达式函数库。
PCRE 存在缓冲区错误漏洞，该漏洞源于当PCRE在启动模式(pattern)指定选项的时候，为了防止将其不必要的编译到字节代码，会如pcre_compile()选项所指定的方式传送回调用程序(也就是/(?i)a|b/ == /a|b/i)。如果模式包含有多个分支的话，就会意外的将新选项回传的过远，仅有第一个分支获得了新的标记，而在第二次编译传送的时候会一直设置新的标记，导致大小计算传送和实际的编译传送之间出现不匹配，这可能触发堆溢出。
solution:Upgrade pcre pcre to a higher version than 7.7,and avoid the version 7.7; Upgrade php php to a higher version than 5.2.7,and avoid the version [5.2.0,5.2.7]; Upgrade debian debian_linux to a higher version than 4.0,and avoid the version 4.0; Upgrade canonical ubuntu_linux to a higher version than 6.06,7.04,7.10,8.04,9.10,and avoid the version 6.06,7.04,7.10,8.04,9.10; Upgrade fedoraproject fedora to a higher version than 8,9,and avoid the version 8,9; Upgrade opensuse opensuse to a higher version than 10.3,and avoid the version 10.3
solution:Upgrade myblog myblog to a higher version than *