PT-2015-7790 · Kde+4 · Konqueror+4

Published 2015-12-01 · Updated 2023-02-16 · CVE-2015-8389

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PCRE versions prior to 8.38

Description The issue allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, such as the /(?:|a|){100}x/ pattern and related patterns. This is demonstrated by a JavaScript RegExp object encountered by Konqueror.

Recommendations For versions prior to 8.38, update to version 8.38 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted regular expressions to minimize the risk of exploitation. Avoid using the RegExp object with untrusted input until the issue is resolved.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-185

CWE-119

Related Identifiers

CVE-2015-8389

SUSE-SU-2016:2971-1

SUSE-SU-2016:3161-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

USN-2943-1

Affected Products

Javascript

Konqueror

Pcre

Suse

Ubuntu

References · 124

• https://ubuntu.com/security/CVE-2015-8389 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8383 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-8389 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8393 · Security Note
• http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8394 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-3210 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8388 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2326 · Security Note
• https://ubuntu.com/security/CVE-2015-8383 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9769 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283 · Security Note
• https://ubuntu.com/security/CVE-2015-8393 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8390 · Security Note