PT-2015-7782 · Pcre+2 · Pcre2+3

Published

2015-12-01

·

Updated

2018-01-05

·

CVE-2015-8381

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions PCRE versions prior to 8.38 PCRE2 versions prior to 10.2x
Description The issue concerns the compile regex function in PCRE and PCRE2, which mishandles certain patterns, such as /(?J:(?|(:(?|(?'R')(k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/ and /(?J:(?|(:(?|(?'R')(z(?|(?'R')(k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/, allowing remote attackers to cause a denial of service or possibly have other unspecified impacts via a crafted regular expression.
Recommendations For PCRE versions prior to 8.38, update to version 8.38 or later. For PCRE2 versions prior to 10.2x, update to version 10.2x or later.

Exploit

Fix

DoS

Buffer Overflow

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2015-8381
RHSA-2016:1132
RHSA-2016:2750
SUSE-SU-2016:2971-1
SUSE-SU-2016:3161-1
SUSE-SU-2017:2699-1
SUSE-SU-2017:2700-1
USN-2943-1

Affected Products

Pcre
Pcre2
Suse
Ubuntu