Description
The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service (crash) via a comment with a crafted URL that triggers many recursive calls.
Remediation
References
Related Vulnerabilities
WordPress Plugin RSVPMaker SQL Injection (9.2.5)
WordPress Plugin MAZ Loader-Preloader Builder for WordPress SQL Injection (1.3.2)
MediaWiki Incorrect Authorization Vulnerability (CVE-2022-29906)
Ruby Other Vulnerability (CVE-2012-5380)
WordPress Plugin VDZ VERIFICATION (Custom Meta Tags) Cross-Site Scripting (1.3.12)