CVE-2016-9643 The regex code in Webkit 2.4.11 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number of ($ (open parenthesis and dollar) followed by {-2,16} and....
HighCVSS 7.5
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The regex code in Webkit 2.4.11 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number of ($ (open parenthesis and dollar) followed by {-2,16} and a large number of +) (plus close parenthesis).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubuntu/qtwebkit-opensource-src(Ubuntu:22.04) | All versions | No fix listed |
| webkit | = 2.4.11 | No fix listed |
| ubuntu/qtwebkit-opensource-src(Ubuntu:24.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-3257-1 vendor-advisory
- www.cve.org
- [oss-security] 20161126 CVE Request: resource exhaustion in regex expression handling in WebKit mailing-list third-party-advisory
- [oss-security] 20161126 Re: CVE Request: resource exhaustion in regex expression handling in WebKit mailing-list third-party-advisory
- 94559 vdb-entry
- 1038137 vdb-entry
- GLSA-201706-15 vendor-advisory