CVE-2015-3210 Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P<B>c)(...
CriticalCVSS 9.8
EPSS 9.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/, a different vulnerability than CVE-2015-8384.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pcre3(Debian:12) | < 2:8.35-7.2 | 2:8.35-7.2 |
| PCRE2 | = 10.10 | No fix listed |
| pcre | = 8.34 | No fix listed |
| pcre | = 8.35 | No fix listed |
| pcre | = 8.36 | No fix listed |
| pcre | = 8.37 | No fix listed |
References
- Debian Security Tracker CVE-2015-3210 vendor-advisory
- RHSA-2016:2750 third-party-advisory vendor-advisory
- [oss-security] 20150601 CVE-2015-3210: PCRE Library Heap Overflow Vulnerability mailing-list
- [oss-security] 20151202 Re: Heap Overflow in PCRE mailing-list
- 74934 broken-link third-party-advisory vdb-entry
- RHSA-2016:1132 third-party-advisory vendor-advisory
- bugs.exim.org exploit issue-tracking vendor-advisory
- bugs.debian.org issue-tracking