Problems while searching for a new upstream version
high
uscan had problems while searching for a new upstream version:
In watch file debian/watch, reading FTP directory
ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/ failed: 500 Connection timed out
Standards version of the package is outdated.
high
The package is severely out of date with respect to the Debian Policy.The package should be updated to follow the last version of Debian Policy
(Standards-Version 4.4.0 instead of
3.9.3).
CVE-2015-3217: PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.
CVE-2017-7244: The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file.
CVE-2017-7186: libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/p/pcre3.png){kind=link}