CVE-2016-1283

Critical

Published: 03/01/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The pcre_compile2 function in PCRE 8.38 mishandles patterns with named subgroups, potentially leading to a heap-based buffer overflow. Remote attackers can exploit this vulnerability by sending a crafted regular expression.

Risk Assessment

This vulnerability may lead to denial of service, affecting the availability of applications using PCRE. There is also a risk of unspecified other impacts on the system.

Recommendation

It is recommended to update to the latest version of PCRE to mitigate this vulnerability. Additionally, monitor applications using this library for unusual behavior.

Original NVD description (English source)

The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.