CVE-2015-8382
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2015-8382
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2015-8382.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2015-8382
- Related
- Published
- 2015-12-02T01:59:05Z
- Modified
- 2024-09-11T02:00:04Z
- Summary
- [none]
- Details
-
The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((ACCEPT)))/ pattern and related patterns involving (ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.
- References
-
- https://bto.bluecoat.com/security-advisory/sa128
- http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
- https://bugs.exim.org/show_bug.cgi?id=1537
- https://bugzilla.redhat.com/show_bug.cgi?id=1187225
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=c351b47ce85a3a147cfa801fa9f0149ab4160834
- http://vcs.pcre.org/pcre/code/trunk/pcre_exec.c?r1=1502&r2=1510
- http://www.openwall.com/lists/oss-security/2015/08/04/3
- http://www.openwall.com/lists/oss-security/2015/11/29/1
- http://www.securityfocus.com/bid/76157
- https://security-tracker.debian.org/tracker/CVE-2015-8382
Affected packages
Debian:11 / pcre3
Package
- Name
- pcre3
- Purl
- pkg:deb/debian/pcre3?arch=source
Debian:12 / pcre3
Package
- Name
- pcre3
- Purl
- pkg:deb/debian/pcre3?arch=source