PT-2016-3606 · Pcre+4 · Pcre2+5
Vasyl Kaigorodov
·
Publicado
2015-11-24
·
Atualizado
2018-05-18
·
CVE-2015-3217
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
PCRE versions 7.8 and 8.32 through 8.37
PCRE2 version 10.10
Description
The issue is related to the mishandling of group empty matches, which could allow remote attackers to cause a denial of service via a crafted regular expression. This might lead to a stack-based buffer overflow.
Recommendations
For PCRE versions 7.8 and 8.32 through 8.37, update to a version that fixes the issue.
For PCRE2 version 10.10, update to a version that fixes the issue.
As a temporary workaround, consider restricting the use of crafted regular expressions to minimize the risk of exploitation.
Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Pcre
Pcre2
Red Hat
Suse