PT-2015-7784 · Philip Hazel+2 · Pcre+2

Published 2015-12-01 · Updated 2023-02-16 · CVE-2015-8383

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PCRE versions prior to 8.38

Description The issue concerns the mishandling of certain repeated conditional groups in regular expressions, which can be exploited by remote attackers to cause a denial of service (buffer overflow) or possibly have other unspecified impacts. This can be achieved through a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Recommendations For PCRE versions prior to 8.38, update to version 8.38 or later to resolve the issue.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2015-8383

RHSA-2016:1132

RHSA-2016:2750

SUSE-SU-2016:2971-1

SUSE-SU-2016:3161-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

USN-2943-1

Affected Products

Pcre

Suse

Ubuntu

References · 124

• https://ubuntu.com/security/CVE-2015-8389 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8383 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8393 · Security Note
• https://ubuntu.com/security/CVE-2015-8394 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-3210 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8383 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8388 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2326 · Security Note
• https://ubuntu.com/security/CVE-2014-9769 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283 · Security Note
• https://ubuntu.com/security/CVE-2015-8393 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8390 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9769 · Security Note
• http://rhn.redhat.com/errata/RHSA-2016-2750.html · Vendor Advisory