CVE-2007-3944 (GCVE-0-2007-3944)
Vulnerability from cvelistv5
Published
2007-07-23 16:00
Modified
2024-08-07 14:37
Severity ?
CWE
  • n/a
Summary
Multiple heap-based buffer overflows in the Perl Compatible Regular Expressions (PCRE) library in the JavaScript engine in WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, allow remote attackers to execute arbitrary code via certain JavaScript regular expressions. NOTE: this issue was originally reported only for MobileSafari on the iPhone. NOTE: it is not clear whether this stems from an issue in the original distribution of PCRE, which might already have a separate CVE identifier.
References
cve@mitre.org http://docs.info.apple.com/article.html?artnum=306173
cve@mitre.org http://docs.info.apple.com/article.html?artnum=306174
cve@mitre.org http://secunia.com/advisories/26287 Vendor Advisory
cve@mitre.org http://www.nytimes.com/2007/07/23/technology/23iphone.html?_r=1&adxnnl=1&adxnnlx=1185163364-1OTsRJvbylLamj17FY2wnw&oref=slogin
cve@mitre.org http://www.securityevaluators.com/iphone/
cve@mitre.org http://www.securityevaluators.com/iphone/exploitingiphone.pdf
cve@mitre.org http://www.securityfocus.com/bid/25002
cve@mitre.org http://www.securitytracker.com/id?1018439
cve@mitre.org http://www.vupen.com/english/advisories/2007/2730 Vendor Advisory
cve@mitre.org http://www.vupen.com/english/advisories/2007/2731 Vendor Advisory
cve@mitre.org https://exchange.xforce.ibmcloud.com/vulnerabilities/35577
af854a3a-2127-422b-91ae-364da2661108 http://docs.info.apple.com/article.html?artnum=306173
af854a3a-2127-422b-91ae-364da2661108 http://docs.info.apple.com/article.html?artnum=306174
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/26287 Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 http://www.nytimes.com/2007/07/23/technology/23iphone.html?_r=1&adxnnl=1&adxnnlx=1185163364-1OTsRJvbylLamj17FY2wnw&oref=slogin
af854a3a-2127-422b-91ae-364da2661108 http://www.securityevaluators.com/iphone/
af854a3a-2127-422b-91ae-364da2661108 http://www.securityevaluators.com/iphone/exploitingiphone.pdf
af854a3a-2127-422b-91ae-364da2661108 http://www.securityfocus.com/bid/25002
af854a3a-2127-422b-91ae-364da2661108 http://www.securitytracker.com/id?1018439
af854a3a-2127-422b-91ae-364da2661108 http://www.vupen.com/english/advisories/2007/2730 Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 http://www.vupen.com/english/advisories/2007/2731 Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 https://exchange.xforce.ibmcloud.com/vulnerabilities/35577
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:37:05.370Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://docs.info.apple.com/article.html?artnum=306173"
          },
          {
            "name": "25002",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25002"
          },
          {
            "name": "iphone-safari-bo(35577)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35577"
          },
          {
            "name": "ADV-2007-2730",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2730"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securityevaluators.com/iphone/"
          },
          {
            "name": "1018439",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018439"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://docs.info.apple.com/article.html?artnum=306174"
          },
          {
            "name": "26287",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26287"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.nytimes.com/2007/07/23/technology/23iphone.html?_r=1\u0026adxnnl=1\u0026adxnnlx=1185163364-1OTsRJvbylLamj17FY2wnw\u0026oref=slogin"
          },
          {
            "name": "ADV-2007-2731",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2731"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.securityevaluators.com/iphone/exploitingiphone.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-07-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple heap-based buffer overflows in the Perl Compatible Regular Expressions (PCRE) library in the JavaScript engine in WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, allow remote attackers to execute arbitrary code via certain JavaScript regular expressions. NOTE: this issue was originally reported only for MobileSafari on the iPhone.  NOTE: it is not clear whether this stems from an issue in the original distribution of PCRE, which might already have a separate CVE identifier."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://docs.info.apple.com/article.html?artnum=306173"
        },
        {
          "name": "25002",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25002"
        },
        {
          "name": "iphone-safari-bo(35577)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35577"
        },
        {
          "name": "ADV-2007-2730",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2730"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securityevaluators.com/iphone/"
        },
        {
          "name": "1018439",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018439"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://docs.info.apple.com/article.html?artnum=306174"
        },
        {
          "name": "26287",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26287"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.nytimes.com/2007/07/23/technology/23iphone.html?_r=1\u0026adxnnl=1\u0026adxnnlx=1185163364-1OTsRJvbylLamj17FY2wnw\u0026oref=slogin"
        },
        {
          "name": "ADV-2007-2731",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2731"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.securityevaluators.com/iphone/exploitingiphone.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-3944",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple heap-based buffer overflows in the Perl Compatible Regular Expressions (PCRE) library in the JavaScript engine in WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, allow remote attackers to execute arbitrary code via certain JavaScript regular expressions. NOTE: this issue was originally reported only for MobileSafari on the iPhone.  NOTE: it is not clear whether this stems from an issue in the original distribution of PCRE, which might already have a separate CVE identifier."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://docs.info.apple.com/article.html?artnum=306173",
              "refsource": "CONFIRM",
              "url": "http://docs.info.apple.com/article.html?artnum=306173"
            },
            {
              "name": "25002",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25002"
            },
            {
              "name": "iphone-safari-bo(35577)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35577"
            },
            {
              "name": "ADV-2007-2730",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/2730"
            },
            {
              "name": "http://www.securityevaluators.com/iphone/",
              "refsource": "MISC",
              "url": "http://www.securityevaluators.com/iphone/"
            },
            {
              "name": "1018439",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1018439"
            },
            {
              "name": "http://docs.info.apple.com/article.html?artnum=306174",
              "refsource": "CONFIRM",
              "url": "http://docs.info.apple.com/article.html?artnum=306174"
            },
            {
              "name": "26287",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26287"
            },
            {
              "name": "http://www.nytimes.com/2007/07/23/technology/23iphone.html?_r=1\u0026adxnnl=1\u0026adxnnlx=1185163364-1OTsRJvbylLamj17FY2wnw\u0026oref=slogin",
              "refsource": "MISC",
              "url": "http://www.nytimes.com/2007/07/23/technology/23iphone.html?_r=1\u0026adxnnl=1\u0026adxnnlx=1185163364-1OTsRJvbylLamj17FY2wnw\u0026oref=slogin"
            },
            {
              "name": "ADV-2007-2731",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/2731"
            },
            {
              "name": "http://www.securityevaluators.com/iphone/exploitingiphone.pdf",
              "refsource": "MISC",
              "url": "http://www.securityevaluators.com/iphone/exploitingiphone.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-3944",
    "datePublished": "2007-07-23T16:00:00",
    "dateReserved": "2007-07-23T00:00:00",
    "dateUpdated": "2024-08-07T14:37:05.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2007-3944\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2007-07-23T16:30:00.000\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple heap-based buffer overflows in the Perl Compatible Regular Expressions (PCRE) library in the JavaScript engine in WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, allow remote attackers to execute arbitrary code via certain JavaScript regular expressions. NOTE: this issue was originally reported only for MobileSafari on the iPhone.  NOTE: it is not clear whether this stems from an issue in the original distribution of PCRE, which might already have a separate CVE identifier.\"},{\"lang\":\"es\",\"value\":\"M\u00faltiples desbordamientos de b\u00fafer en la regi\u00f3n heap de la memoria en la biblioteca de Perl Compatible Regular Expressions (PCRE) en el motor de JavaScript en WebKit en Apple Safari versi\u00f3n 3 Beta anterior al Update 3.0.3 y iPhone versiones anteriores a 1.0.1, permiten a atacantes remotos ejecutar c\u00f3digo arbitrario por medio de cierto expresiones regulares de JavaScript. NOTA: este problema se report\u00f3 originalmente solo para MobileSafari en el iPhone. NOTA: no est\u00e1 claro si esto es debido a un problema en la distribuci\u00f3n original de PCRE, que ya podr\u00eda tener un identificador CVE por separado.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":9.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"},{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apple:safari:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A33F900-D405-40A8-A0A5-3C80320FF6E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apple:webkit:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"461EFB63-7933-488C-BB4E-7C913364F5A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.0.0\",\"matchCriteriaId\":\"F1C626E5-6835-41C8-91A3-F4FB0A36DBFD\"}]}]}],\"references\":[{\"url\":\"http://docs.info.apple.com/article.html?artnum=306173\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://docs.info.apple.com/article.html?artnum=306174\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/26287\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.nytimes.com/2007/07/23/technology/23iphone.html?_r=1\u0026adxnnl=1\u0026adxnnlx=1185163364-1OTsRJvbylLamj17FY2wnw\u0026oref=slogin\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityevaluators.com/iphone/\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityevaluators.com/iphone/exploitingiphone.pdf\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/25002\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id?1018439\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2007/2730\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/2731\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/35577\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://docs.info.apple.com/article.html?artnum=306173\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://docs.info.apple.com/article.html?artnum=306174\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/26287\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.nytimes.com/2007/07/23/technology/23iphone.html?_r=1\u0026adxnnl=1\u0026adxnnlx=1185163364-1OTsRJvbylLamj17FY2wnw\u0026oref=slogin\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityevaluators.com/iphone/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityevaluators.com/iphone/exploitingiphone.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/25002\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id?1018439\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2007/2730\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.vupen.com/english/advisories/2007/2731\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/35577\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.