PT-2015-7786 · Philip Hazel+4 · Pcre+4

Published 2015-12-01 · Updated 2019-12-27 · CVE-2015-8385

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PCRE versions prior to 8.38

Description The issue concerns a denial of service (buffer overflow) that can be caused by remote attackers through crafted regular expressions. This can potentially have other unspecified impacts. The problem is demonstrated by a JavaScript RegExp object encountered by Konqueror, specifically with the /(?|(k'Pm')|(?'Pm'))/ pattern and related patterns that contain certain forward references.

Recommendations For versions prior to 8.38, update to version 8.38 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted regular expressions that may trigger the buffer overflow until a patch is applied. Avoid using the RegExp object with the vulnerable pattern in affected applications to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CESA-2016_1025

CVE-2015-8385

RHSA-2016:1025

RHSA-2016:1132

RHSA-2016:2750

RHSA-2016_1025

SUSE-SU-2016:2971-1

SUSE-SU-2016:3161-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

USN-2943-1

Affected Products

Centos

Pcre

Red Hat

Suse

Ubuntu

References · 141

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8380 · Security Note
• https://ubuntu.com/security/CVE-2015-5073 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8381 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8394 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:3161-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5073 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2328 · Security Note
• https://bdu.fstec.ru/vul/2022-04560 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283 · Security Note
• https://ubuntu.com/security/CVE-2015-2326 · Vendor Advisory
• http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9769 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3217 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3210 · Security Note
• https://ubuntu.com/security/CVE-2015-8385 · Vendor Advisory