CVE-2015-8390

Critical

Published: 02/12/2015(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

PCRE before 8.38 mishandles the [: and \ substrings in character classes, allowing remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression.

Risk Assessment

Organizations may be exposed to attacks leading to denial of service, affecting the availability of applications using PCRE.

Recommendation

It is recommended to upgrade to PCRE version 8.38 or later to mitigate this vulnerability.

Original NVD description (English source)

PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.