PT-2015-7784 · Philip Hazel+2 · Pcre+2

Publicado 2015-12-01 · Atualizado 2023-02-16 · CVE-2015-8383

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PCRE versions prior to 8.38

Description The issue concerns the mishandling of certain repeated conditional groups in regular expressions, which can be exploited by remote attackers to cause a denial of service (buffer overflow) or possibly have other unspecified impacts. This can be achieved through a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Recommendations For PCRE versions prior to 8.38, update to version 8.38 or later to resolve the issue.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2015-8383

RHSA-2016:1132

RHSA-2016:2750

SUSE-SU-2016:2971-1

SUSE-SU-2016:3161-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

USN-2943-1

Produtos afetados

Pcre

Suse

Ubuntu

Referências · 124

• https://suse.com/security/cve/CVE-2015-5073 · Nota
• https://bugzilla.suse.com/936227 · Nota
• https://bugs.exim.org/show_bug.cgi?id=1503 · Nota
• https://ubuntu.com/security/CVE-2015-8389 · Aviso do Fabricante
• https://bugzilla.suse.com/971741 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8383 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8393 · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-8394 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/11/29/1 · Nota
• https://ubuntu.com/security/CVE-2015-3210 · Aviso do Fabricante
• https://bugs.exim.org/show_bug.cgi?id=1791 · Nota
• https://suse.com/security/cve/CVE-2015-2327 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-8383 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8388 · Nota de Segurança