PT-2015-7793 · Philip Hazel+2 · Pcre+2

Publicado 2015-12-01 · Atualizado 2023-02-16 · CVE-2015-8393

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PCRE versions prior to 8.38

Description The issue concerns the mishandling of the -q option for binary files by pcregrep in PCRE, potentially allowing remote attackers to obtain sensitive information via a crafted file. This could be exploited through a CGI script that sends stdout data to a client.

Recommendations For versions prior to 8.38, update to version 8.38 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-8393

SUSE-SU-2016:2971-1

SUSE-SU-2016:3161-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

USN-2943-1

Produtos afetados

Pcre

Suse

Ubuntu

Referências · 123

• https://suse.com/security/cve/CVE-2015-5073 · Nota
• https://bugzilla.suse.com/936227 · Nota
• https://bugs.exim.org/show_bug.cgi?id=1503 · Nota
• https://ubuntu.com/security/CVE-2015-8389 · Aviso do Fabricante
• https://bugzilla.suse.com/971741 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8383 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8393 · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-8394 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/11/29/1 · Nota
• https://ubuntu.com/security/CVE-2015-3210 · Aviso do Fabricante
• https://bugs.exim.org/show_bug.cgi?id=1791 · Nota
• https://suse.com/security/cve/CVE-2015-2327 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8388 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8393 · Aviso do Fabricante