CVE-2015-8386
CriticalSummary
PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
Risk Assessment
Organizations may be exposed to attacks leading to denial of service, affecting the availability of their services. Additionally, there is a risk of unspecified impact on systems, potentially leading to further security issues.
Recommendation
It is recommended to upgrade to PCRE version 8.38 or later to mitigate this vulnerability. Monitoring the use of regular expressions in applications is also advised to minimize the risk of attacks.
Other vulnerabilities in PCRE
See all- CVE-2014-9769High
PCRE 8.35 has an issue with optimizing nested alternatives, which can lead to denial of service through stack memory corruption. Remote attackers can exploit this vulnerability by sending a crafted string.
- CVE-2015-8395High
PCRE before 8.38 mishandles certain references, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8392High
PCRE before 8.38 mishandles certain instances of the (?| substring, allowing remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8388High
PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8387High
PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, allowing remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-2328High
PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2020-14155Medium
The libpcre library in PCRE before version 8.44 is vulnerable to an integer overflow. The issue occurs when a large number is used after the (?C substring in a regular expression.
- CVE-2017-13846Critical
An issue was discovered in certain Apple products, including macOS before 10.13.1, related to the third-party 'PCRE' product. Versions before 8.40 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
- CVE-2016-1283Critical
The pcre_compile2 function in PCRE 8.38 mishandles patterns with named subgroups, potentially leading to a heap-based buffer overflow. Remote attackers can exploit this vulnerability by sending a crafted regular expression.
- CVE-2015-8394Critical
PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, allowing remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression.
Original NVD description (English source)
PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.