Loading story…
Gentoo resolved CVE-2019-20838 and CVE-2020-14155 in dev-libs/libpcre by stabilizing PCRE version 8.44 across supported architectures and removing vulnerable 8.42 and 8.43 ebuilds. The Gentoo advisory was closed as RESOLVED FIXED after repository cleanup was completed.
The corrected PCRE releases address a JIT subject-buffer overread triggered by particular patterns when UTF support is disabled, an integer-overflow condition while parsing a number after (?C, and a NULL-pointer dereference in pcretest. Organizations using Gentoo systems should ensure installed libpcre packages are upgraded to 8.44 or a later supported version.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Thomas Deutschmann recorded that the repository was clean and remediation for Bug 717920 was complete; the bug was marked RESOLVED FIXED.
Gentoo commit 577e461933395f3e973e0c153e3a1080cdf0a284 performed security cleanup for Bug 717920 by removing the libpcre-8.42.ebuild and libpcre-8.43.ebuild files.
Gentoo stabilized libpcre 8.44 for arm, x86, amd64, ppc, ppc64, sparc, hppa, and s390 during August and September 2020.
Sam James reported Gentoo Bug 717920 to track vulnerabilities in dev-libs/libpcre, including CVE-2019-20838 and CVE-2020-14155. Gentoo identified libpcre 8.44 as the resolution target.
PCRE 8.44 added validation for the numeric value following (?C to prevent an integer overflow and corrected a NULL dereference in pcretest.
PCRE 8.43 fixed a JIT-processing subject-buffer overread affecting UTF-disabled patterns that use \X or \R with a fixed quantifier greater than one. Yunho Kim identified the issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Maintainers of **libevent** and **libexpat (Expat)** released security updates to fix multiple high-severity vulnerabilities affecting widely used networking and XML parsing components. **libevent 2.1.13-stable** and **2.2.2-alpha** remediate memory-safety bugs across `evbuffer`, `bufferevent`, `evtag`, `evrpc`, `evdns`, and `evhttp`, including out-of-bounds reads and writes, integer overflow, and a dangling pointer, alongside HTTP parsing weaknesses that could enable request smuggling, header smuggling, parser mismatch, and access-control bypass. One libevent fix tightened chunked-transfer parsing to require strict `CRLF` handling in line with RFC 9112, while later CVE records identified issues such as signed/unsigned length conversion in `evtag_unmarshal_header()` (`CVE-2026-63384`) and HTTP header and URI parsing bugs (`CVE-2026-63385`) in versions prior to the patched releases. **libexpat 2.8.2** was published to fix 14 vulnerabilities spanning integer overflows, out-of-bounds writes, missing control-flow integrity checks, and unsafe parser API behavior in functions including `XML_ParseBuffer`, `storeAtts`, `addBinding`, `getAttributeId`, and `doProlog`, as well as several flaws in the `xmlwf` utility. A subsequent high-severity disclosure, `CVE-2026-76641`, showed that Expat versions through **2.8.3** still contained an out-of-bounds read in external entity parsing caused by a struct size mismatch introduced by an earlier fix, creating risks of memory corruption, wild-pointer dereference, and denial of service. Together, the disclosures highlight continued patching activity for foundational open-source libraries embedded in network-facing and XML-processing software.
Aug 21, 2026
GNU released **Coreutils 9.12**, delivering 288 commits from 16 contributors and fixes for multiple memory-safety and reliability defects in foundational GNU command-line utilities. The release addresses a CWE-126 possible buffer over-read in `factor`; freed-memory reads in `ls --color`; heap-buffer overflows in `unexpand`; and read-buffer or lookup-table over-reads affecting `uniq` and `wc`. It also resolves long-standing recursive traversal failures in `chcon`, `chgrp`, `chmod`, `chown`, `du`, and `ls` when files are removed concurrently. The update fixes infinite-loop and hang conditions in `ptx`, `tee`, `shred`, and `truncate`, while improving filesystem handling and performance in `cut`, `uniq`, and `sort`, including better handling of piped input. New features include `env --env0-from=FILE` for environment persistence, safer quoting and terminal-output behavior, and labeled `uname` output. Organizations packaging or operating GNU/Linux systems should prioritize testing and deploying Coreutils 9.12 where affected utilities process untrusted, malformed, or concurrently changing files and input.
Sep 17, 2026
Red Hat released **Important** glibc security updates for Red Hat Enterprise Linux 7, 8, and 9—including extended, advanced-update, and extended-lifecycle support channels—to remediate `CVE-2024-2961`. The flaw affects the `ISO-2022-CN-EXT` `iconv` conversion module: incomplete internal-buffer checks for SS2 and SS3 charset-switch escape sequences during UCS-4 conversion can write one to three bytes beyond the intended buffer. Red Hat assigned the issue a CVSS v3.1 score of 8.8; successful exploitation may cause memory corruption, denial of service, privilege escalation, or remote code execution depending on the calling application and conditions. The updates also resolve four glibc/nscd netgroup-cache vulnerabilities, including a stack-based buffer overflow, null-pointer dereferences, allocation-failure daemon termination, and unsafe handling of NSS callback strings. Administrators should deploy the updated glibc packages across affected x86_64, ARM64/aarch64, IBM Z/s390x, and IBM Power architectures, then restart all glibc-linked services or reboot hosts. Where patching cannot be performed immediately, Red Hat recommends disabling the vulnerable `ISO-2022-CN-EXT` gconv module and rebuilding the `iconv` cache; fixes were also issued for OpenShift Container Platform 4.12 through 4.16.
Aug 27, 2026