CVE-2015-5073
CriticalSummary
A heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 can be exploited by remote attackers. This may lead to denial of service (crash) or disclosure of sensitive information from heap memory.
Risk Assessment
The organization may experience service outages and potential leakage of sensitive data, which could lead to serious security implications.
Recommendation
It is recommended to upgrade to PCRE version 8.38 or later to mitigate this vulnerability.
Other vulnerabilities in PCRE (Perl Compatible Regular Expressions)
See all- CVE-2017-6004High
The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.
- CVE-2015-8393High
pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file.
- CVE-2015-2327High
PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8390Critical
PCRE before 8.38 mishandles the [: and \ substrings in character classes, allowing remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression.
Original NVD description (English source)
Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.