CVE-2015-8385
HighSummary
The vulnerability in PCRE before version 8.38 mishandles patterns with certain forward references, which can lead to a buffer overflow and potentially other impacts via a crafted regular expression.
Risk Assessment
A remote attacker can exploit this vulnerability to cause a denial of service (DoS) or potentially other unspecified impacts, threatening system availability and integrity.
Recommendation
Update PCRE library to version 8.38 or later, and update all applications using PCRE, including browsers like Konqueror.
Other vulnerabilities in PCRE (Perl Compatible Regular Expressions) przed wersją 8.38
See all- CVE-2015-8384High
The vulnerability in PCRE before version 8.38 mishandles patterns with certain recursive back references, allowing a remote attacker to cause a denial of service (buffer overflow) or possibly other impacts via a crafted regular expression.
- CVE-2015-8380High
The pcre_exec function in PCRE before 8.38 mishandles a // pattern with a \01 string, allowing remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have other impacts via a crafted regular expression, as demonstrated by a JavaScript RegExp object in Konqueror.
Original NVD description (English source)
PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.