PT-2015-7782 · Pcre+2 · Pcre2+3

Publicado

2015-12-01

·

Atualizado

2018-01-05

·

CVE-2015-8381

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions PCRE versions prior to 8.38 PCRE2 versions prior to 10.2x
Description The issue concerns the compile regex function in PCRE and PCRE2, which mishandles certain patterns, such as /(?J:(?|(:(?|(?'R')(k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/ and /(?J:(?|(:(?|(?'R')(z(?|(?'R')(k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/, allowing remote attackers to cause a denial of service or possibly have other unspecified impacts via a crafted regular expression.
Recommendations For PCRE versions prior to 8.38, update to version 8.38 or later. For PCRE2 versions prior to 10.2x, update to version 10.2x or later.

Exploit

Correção

DoS

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2015-8381
RHSA-2016:1132
RHSA-2016:2750
SUSE-SU-2016:2971-1
SUSE-SU-2016:3161-1
SUSE-SU-2017:2699-1
SUSE-SU-2017:2700-1
USN-2943-1

Produtos afetados

Pcre
Pcre2
Suse
Ubuntu