PT-2015-6766 · Pcre+5 · Pcre+5
Guanxing Wen
·
Publicado
2015-06-26
·
Atualizado
2018-05-18
·
CVE-2015-5073
CVSS v3.1
9.1
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
PCRE versions prior to 8.38
Description
The issue is related to a heap-based buffer overflow in the
find fixedlength function, which can be triggered by a crafted regular expression with an excess closing parenthesis. This can cause a denial of service (crash) or allow remote attackers to obtain sensitive information from heap memory, potentially bypassing the ASLR protection mechanism.Recommendations
For versions prior to 8.38, update to version 8.38 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted regular expressions to minimize the risk of exploitation.
Exploit
Correção
DoS
Information Disclosure
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Pcre
Red Hat
Suse
Ubuntu