CVE-2015-3217
CVE-2015-3217
This page contains facts from public vulnerability sources. Check the original advisory before updating.
PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.
CVSS 7.5 · High · EPSS 6.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
Original sources
- https://access.redhat.com/errata/RHSA-2016:1132
- http://vcs.pcre.org/pcre?view=revision&revision=1566
- https://bugs.exim.org/show_bug.cgi?id=1638
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.openwall.com/lists/oss-security/2015/06/03/7
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
- http://rhn.redhat.com/errata/RHSA-2016-1025.html
- http://rhn.redhat.com/errata/RHSA-2016-2750.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1228283
- http://www.securityfocus.com/bid/75018
- https://nvd.nist.gov/vuln/detail/CVE-2015-3217