PT-2015-7781 · Pcre+2 · Pcre+2

Publicado

2015-12-01

·

Atualizado

2017-07-01

·

CVE-2015-8380

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions PCRE versions prior to 8.38
Description The issue is related to the pcre exec function in pcre exec.c, which mishandles a // pattern with a 01 string. This can be exploited by remote attackers to cause a denial of service, specifically a heap-based buffer overflow, or possibly have other unspecified impacts. The issue can be triggered via a crafted regular expression.
Recommendations For versions prior to 8.38, update to version 8.38 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted regular expressions to minimize the risk of exploitation.

Exploit

Correção

DoS

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2015-8380
SUSE-SU-2016:2971-1
SUSE-SU-2016:3161-1
SUSE-SU-2017:2699-1
SUSE-SU-2017:2700-1
USN-2943-1

Produtos afetados

Pcre
Suse
Ubuntu