CVE-2015-5073
CriticalSummary
A heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 can be exploited by remote attackers. This may lead to denial of service (crash) or disclosure of sensitive information from heap memory.
Risk Assessment
The organization may experience service outages and potential leakage of sensitive data, which could lead to serious security implications.
Recommendation
It is recommended to upgrade to PCRE version 8.38 or later to mitigate this vulnerability.
Original NVD description (English source)
Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.