CVE-2015-8390
CriticalSummary
PCRE before 8.38 mishandles the [: and \ substrings in character classes, allowing remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression.
Risk Assessment
Organizations may be exposed to attacks leading to denial of service, affecting the availability of applications using PCRE.
Recommendation
It is recommended to upgrade to PCRE version 8.38 or later to mitigate this vulnerability.
Other vulnerabilities in PCRE (Perl Compatible Regular Expressions)
See all- CVE-2017-6004High
The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.
- CVE-2015-8393High
pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file.
- CVE-2015-2327High
PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-5073Critical
A heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 can be exploited by remote attackers. This may lead to denial of service (crash) or disclosure of sensitive information from heap memory.
Original NVD description (English source)
PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.