The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade php7Upgrade php5Upgrade pcre | Aug 30, 2017 | Jan 3, 2016 |
| Amazon_linux | — | Upgrade php70Upgrade php71Upgrade php56 | Nov 21, 2017 | Jan 2, 2016 |
| Debian | — | Upgrade pcre3 | Jul 30, 2024 | Jan 3, 2016 |
| Freebsd | — | Upgrade php56Upgrade pcreUpgrade php70Upgrade php71 | Oct 30, 2017 | Apr 3, 2016 |
| Gentoo Linux | — | Upgrade dev-libs/libpcre. | Oct 30, 2017 | Jan 2, 2016 |
| Oracle Solaris | — | Upgrade web/php-56 to version 5.6.34-0.175.3.31.0.2.0 on Solaris 11.3Upgrade library/pcre to version 8.38-0.175.3.7.0.1.0 on Solaris 11.3Upgrade web/php-71 to version 7.1.15-0.175.3.31.0.2.0 on Solaris 11.3 | May 29, 2017 | Jan 2, 2016 |
| Php | — | Upgrade to PHP version 7.1.11Upgrade to PHP version 5.6.32Upgrade to PHP version 7.0.25 | Sep 15, 2022 | Jan 3, 2016 |
| Suse | — | Upgrade pcre-toolsUpgrade libpcrecpp0Upgrade libpcreposix0Upgrade libpcre1-32bitUpgrade pcre-develUpgrade libpcre1Upgrade libpcre16-0Upgrade pcre-devel-staticUpgrade sles12sp1-docker-imageUpgrade libpcrecpp0-32bitUpgrade sles12-docker-image | Nov 15, 2016 | Jan 2, 2016 |
| Ubuntu | — | Upgrade libpcre3 | Apr 4, 2016 | Jan 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub