CVE-2016-3191 The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parenth...
CriticalCVSS 9.8
EPSS 8.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pcre2(Debian:12) | < 10.21-1 | 10.21-1 |
| debian/pcre2(Debian:13) | < 10.21-1 | 10.21-1 |
| debian/pcre2(Debian:14) | < 10.21-1 | 10.21-1 |
| debian/pcre3(Debian:12) | < 2:8.38-2 | 2:8.38-2 |
| pcre | = 8.00 | No fix listed |
| pcre | = 8.01 | No fix listed |
| pcre | = 8.02 | No fix listed |
| pcre | = 8.10 | No fix listed |
| pcre | = 8.11 | No fix listed |
| pcre | = 8.12 | No fix listed |
| pcre | = 8.13 | No fix listed |
| pcre | = 8.20 | No fix listed |
| pcre | = 8.21 | No fix listed |
| pcre | = 8.30 | No fix listed |
| pcre | = 8.31 | No fix listed |
| pcre | = 8.32 | No fix listed |
| pcre | = 8.33 | No fix listed |
| pcre | = 8.34 | No fix listed |
| pcre | = 8.35 | No fix listed |
| pcre | = 8.36 | No fix listed |
| pcre | = 8.37 | No fix listed |
| pcre | = 8.38 | No fix listed |
| PCRE2 | <= 10.21 | No fix listed |
| alpine/pcre(Alpine:v3.4) | < 8.38-r1 | 8.38-r1 |
References
- Debian Security Tracker CVE-2016-3191 vendor-advisory
- RHSA-2016:1025 vendor-advisory
- vcs.pcre.org
- vcs.pcre.org
- www-01.ibm.com
- www.oracle.com
- 84810 vdb-entry
- RHSA-2016:1132 vendor-advisory
- bto.bluecoat.com
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking
- bugs.exim.org exploit
- bugzilla.redhat.com
- www.tenable.com
- security.alpinelinux.org vendor-advisory