CVE-2015-8388
HighSummary
PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
Risk Assessment
Organizations may be exposed to attacks leading to denial of service, affecting the availability of systems and applications. Additionally, there is a risk of unspecified impacts that could affect data security.
Recommendation
It is recommended to upgrade to PCRE version 8.38 or later to mitigate this vulnerability. Also, monitor and analyze the use of regular expressions in applications to minimize risk.
Other vulnerabilities in PCRE
See all- CVE-2014-9769High
PCRE 8.35 has an issue with optimizing nested alternatives, which can lead to denial of service through stack memory corruption. Remote attackers can exploit this vulnerability by sending a crafted string.
- CVE-2015-8395High
PCRE before 8.38 mishandles certain references, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8392High
PCRE before 8.38 mishandles certain instances of the (?| substring, allowing remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8387High
PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, allowing remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-2328High
PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2020-14155Medium
The libpcre library in PCRE before version 8.44 is vulnerable to an integer overflow. The issue occurs when a large number is used after the (?C substring in a regular expression.
- CVE-2017-13846Critical
An issue was discovered in certain Apple products, including macOS before 10.13.1, related to the third-party 'PCRE' product. Versions before 8.40 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
- CVE-2016-1283Critical
The pcre_compile2 function in PCRE 8.38 mishandles patterns with named subgroups, potentially leading to a heap-based buffer overflow. Remote attackers can exploit this vulnerability by sending a crafted regular expression.
- CVE-2015-8394Critical
PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, allowing remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-8391Critical
The pcre_compile function in PCRE before 8.38 mishandles certain [: nesting, which can lead to denial of service (CPU consumption) or other unspecified impacts via a crafted regular expression.
Original NVD description (English source)
PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.