What is CVE-2020-14155?

CVE-2020-14155 is a medium-severity software vulnerability (Integer overflow) with a CVSS score of 5.3. libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

Is CVE-2020-14155 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 4%.

What products does CVE-2020-14155 affect?

Tracked products affected include GitLab, macOS. Check the version you run to see whether it is affected.

How do I fix CVE-2020-14155?

Apply the vendor fix in your normal patch cycle. An official patch or advisory is available. Upgrade affected products to a fixed version.

← All products

CVE-2020-14155

MEDIUM severity · CVSS 5.3 · Integer overflow

5.3CVSS MEDIUM

Summary

libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactNone

Integrity impactNone

Availability impactLow

Exploit probability (EPSS)4%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products we track (2)

GitLab macOS

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Official patch: https://bugs.gentoo.org/717920 ↗

Additional information

NVD record
https://bugs.gentoo.org/717920Patch
http://seclists.org/fulldisclosure/2020/Dec/32Advisory
http://seclists.org/fulldisclosure/2021/Feb/14Advisory
https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/Advisory
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3EAdvisory
https://security.netapp.com/advisory/ntap-20221028-0010/Advisory
https://support.apple.com/kb/HT211931Advisory
https://support.apple.com/kb/HT212147Advisory