CVE-2015-8394 PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a...
CriticalCVSS 9.8
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pcre3(Debian:12) | < 2:8.38-1 | 2:8.38-1 |
| PCRE perl compatible regular expression library | <= 8.37 | No fix listed |
| PHP | >= 5.5.0, < 5.5.32 | 5.5.32 |
| PHP | >= 5.6.0, < 5.6.18 | 5.6.18 |
| PHP | >= 7.0.0, < 7.0.3 | 7.0.3 |
References
- Debian Security Tracker CVE-2015-8394 vendor-advisory
- FEDORA-2015-eb896290d3 mailing-list third-party-advisory vendor-advisory
- vcs.pcre.org broken-link
- [oss-security] 20151128 Re: Heap Overflow in PCRE mailing-list third-party-advisory
- 82990 third-party-advisory vdb-entry
- bto.bluecoat.com permissions-required third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- GLSA-201607-02 third-party-advisory vendor-advisory
- security.netapp.com