PT-2015-7789 · Philip Hazel+4 · Pcre+4

Published 2015-12-01 · Updated 2019-12-27 · CVE-2015-8388

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PCRE versions prior to 8.38

Description The issue concerns the mishandling of certain patterns, such as /(?=di(?<=(?1))|(?=(.))))/, which contain an unmatched closing parenthesis. This allows remote attackers to cause a denial of service, potentially leading to a buffer overflow, or possibly have other unspecified impacts through a crafted regular expression. This has been demonstrated using a JavaScript RegExp object encountered by Konqueror.

Recommendations For versions prior to 8.38, update to version 8.38 or later to resolve the issue.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-185

Related Identifiers

CESA-2016_1025

CVE-2015-8388

RHSA-2016:1025

RHSA-2016:1132

RHSA-2016:2750

RHSA-2016_1025

SUSE-SU-2016:2971-1

SUSE-SU-2016:3161-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

USN-2943-1

Affected Products

Centos

Pcre

Red Hat

Suse

Ubuntu

References · 141

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8380 · Security Note
• https://ubuntu.com/security/CVE-2015-5073 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8381 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8394 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:3161-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5073 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2328 · Security Note
• https://bdu.fstec.ru/vul/2022-04560 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283 · Security Note
• https://ubuntu.com/security/CVE-2015-2326 · Vendor Advisory
• http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9769 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3217 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3210 · Security Note
• https://ubuntu.com/security/CVE-2015-8385 · Vendor Advisory