CVE-2015-8384
HighSummary
The vulnerability in PCRE before version 8.38 mishandles patterns with certain recursive back references, allowing a remote attacker to cause a denial of service (buffer overflow) or possibly other impacts via a crafted regular expression.
Risk Assessment
An attacker can exploit this vulnerability to perform a DoS attack on applications using PCRE, such as the Konqueror browser, potentially leading to crashes or uncontrolled system behavior.
Recommendation
Update the PCRE library to version 8.38 or later, which includes a fix for this issue.
Other vulnerabilities in PCRE (Perl Compatible Regular Expressions) przed wersją 8.38
See all- CVE-2015-8385High
The vulnerability in PCRE before version 8.38 mishandles patterns with certain forward references, which can lead to a buffer overflow and potentially other impacts via a crafted regular expression.
- CVE-2015-8380High
The pcre_exec function in PCRE before 8.38 mishandles a // pattern with a \01 string, allowing remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have other impacts via a crafted regular expression, as demonstrated by a JavaScript RegExp object in Konqueror.
Original NVD description (English source)
PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8392 and CVE-2015-8395.