CVE-2015-8394

Critical

Published: 02/12/2015(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, allowing remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression.

Risk Assessment

Organizations may be exposed to attacks leading to denial of service, impacting the availability of their systems. Additionally, there is a risk of unspecified impacts that could affect data integrity and confidentiality.

Recommendation

It is recommended to upgrade to PCRE version 8.38 or later to mitigate this vulnerability. Monitoring and analyzing the use of regular expressions in applications is also advised to minimize the risk of attacks.

Original NVD description (English source)

PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.