CVE-2015-3217

HIGH

PCRE 7.8 8.32-8.37 and PCRE2 10.10 - Denial of Service via Crafted Regular Expression

Title source: llm
STIX 2.1

Description

PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.

References (10)

Core 10
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2016:1132
Exploit, Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugs.exim.org/show_bug.cgi?id=1638
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/06/03/7
Third Party Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-1025.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2750.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1228283
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/75018

Scores

CVSS v3 7.5
EPSS 0.0617
EPSS Percentile 92.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-119
Status published
Products (10)
ibm/powerkvm 2.1
ibm/powerkvm 3.1
pcre/pcre 7.8
pcre/pcre 8.32
pcre/pcre 8.33
pcre/pcre 8.34
pcre/pcre 8.35
pcre/pcre 8.36
pcre/pcre 8.37
pcre/pcre2 10.10
Published Dec 13, 2016
Tracked Since Feb 18, 2026