The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/, a different vulnerability than CVE-2015-8384.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade pcre | Nov 8, 2019 | Dec 13, 2016 |
| Debian | — | Upgrade pcre3 | Jul 30, 2024 | Dec 13, 2016 |
| F5 Big Ip | — | — | Feb 16, 2017 | Sep 8, 2015 |
| Freebsd | — | Upgrade pcre | Dec 10, 2025 | Jun 4, 2015 |
| Oracle Solaris | — | Upgrade library/pcre to version 8.38-0.175.3.5.0.1.0 on Solaris 11.3Upgrade library/pcre to version 8.37-0.175.2.13.0.3.0 on Solaris 11.2 | May 29, 2017 | Dec 13, 2016 |
| Suse | — | Upgrade libpcrecpp0-32bitUpgrade pcre-devel-staticUpgrade sles12sp1-docker-imageUpgrade libpcreposix0Upgrade pcre-develUpgrade libpcre16-0Upgrade libpcre1Upgrade sles12-docker-imageUpgrade libpcrecpp0Upgrade pcre-toolsUpgrade libpcre1-32bit | Dec 13, 2016 | Dec 13, 2016 |
| Ubuntu | — | Upgrade libpcre3 | Apr 4, 2016 | Mar 29, 2016 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub