CVE-2015-8393
HighSummary
pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file.
Risk Assessment
Organizations may be exposed to sensitive data leaks, potentially leading to serious legal and reputational consequences.
Recommendation
It is recommended to update PCRE to version 8.38 or later and to monitor the use of pcregrep in the context of binary files.
Other vulnerabilities in PCRE (Perl Compatible Regular Expressions)
See all- CVE-2017-6004High
The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.
- CVE-2015-2327High
PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2015-5073Critical
A heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 can be exploited by remote attackers. This may lead to denial of service (crash) or disclosure of sensitive information from heap memory.
- CVE-2015-8390Critical
PCRE before 8.38 mishandles the [: and \ substrings in character classes, allowing remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression.
Original NVD description (English source)
pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client.