CVE-2016-1283 The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'){97)?J)?J)(?'R'(?'R'){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/....
CriticalCVSS 9.8
EPSS 7.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'){97)?J)?J)(?'R'(?'R'){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pcre3(Debian:12) | < 2:8.38-3.1 | 2:8.38-3.1 |
| pcre | = 8.38 | No fix listed |
| PHP | >= 5.6.0, < 5.6.32 | 5.6.32 |
| PHP | >= 7.0.0, < 7.0.25 | 7.0.25 |
| PHP | >= 7.1.0, < 7.1.11 | 7.1.11 |
| fedoraproject fedora | = 22 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| oracle solaris | = 11.3 | No fix listed |
| alpine/pcre(Alpine:v3.4) | < 8.38-r1 | 8.38-r1 |
| alpine/php5(Alpine:v3.5) | < 5.6.32-r0 | 5.6.32-r0 |
| alpine/php7(Alpine:v3.5) | < 7.0.25-r0 | 7.0.25-r0 |
| alpine/php7(Alpine:v3.7) | < 7.1.11-r0 | 7.1.11-r0 |
References
- Debian Security Tracker CVE-2016-1283 vendor-advisory
- FEDORA-2016-65833b5dbc mailing-list third-party-advisory vendor-advisory
- FEDORA-2016-f5af8e27ce mailing-list third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- 79825 third-party-advisory vdb-entry
- 1034555 broken-link third-party-advisory vdb-entry
- SSA:2016-172-02 third-party-advisory vendor-advisory
- RHSA-2016:1132 third-party-advisory vendor-advisory
- bto.bluecoat.com permissions-required third-party-advisory
- bugs.exim.org exploit issue-tracking permissions-required third-party-advisory
- GLSA-201607-02 third-party-advisory vendor-advisory
- www.tenable.com third-party-advisory
- www.tenable.com third-party-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking