CVE-2015-8380
HighSummary
The pcre_exec function in PCRE before 8.38 mishandles a // pattern with a \01 string, allowing remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have other impacts via a crafted regular expression, as demonstrated by a JavaScript RegExp object in Konqueror.
Risk Assessment
The risk involves potential remote code execution or application crash when processing regular expressions, leading to data breaches or service unavailability.
Recommendation
It is recommended to immediately upgrade PCRE to version 8.38 or later, which includes a fix for this vulnerability.
Other vulnerabilities in PCRE (Perl Compatible Regular Expressions) przed wersją 8.38
See all- CVE-2015-8385High
The vulnerability in PCRE before version 8.38 mishandles patterns with certain forward references, which can lead to a buffer overflow and potentially other impacts via a crafted regular expression.
- CVE-2015-8384High
The vulnerability in PCRE before version 8.38 mishandles patterns with certain recursive back references, allowing a remote attacker to cause a denial of service (buffer overflow) or possibly other impacts via a crafted regular expression.
Original NVD description (English source)
The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.