The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade pcreUpgrade php5Upgrade php7 | Aug 30, 2017 | Jan 3, 2016 |
| Amazon_linux | — | Upgrade php70Upgrade php71Upgrade php56 | Nov 21, 2017 | Jan 2, 2016 |
| Debian | — | Upgrade pcre3 | Jul 30, 2024 | Jan 3, 2016 |
| Freebsd | — | Upgrade pcreUpgrade php56Upgrade php71Upgrade php70 | Oct 30, 2017 | Apr 3, 2016 |
| Gentoo Linux | — | Upgrade dev-libs/libpcre. | Oct 30, 2017 | Jan 2, 2016 |
| Oracle Solaris | — | Upgrade web/php-71 to version 7.1.15-0.175.3.31.0.2.0 on Solaris 11.3Upgrade library/pcre to version 8.38-0.175.3.7.0.1.0 on Solaris 11.3Upgrade web/php-56 to version 5.6.34-0.175.3.31.0.2.0 on Solaris 11.3 | May 29, 2017 | Jan 2, 2016 |
| Php | — | Upgrade to PHP version 5.6.32Upgrade to PHP version 7.1.11Upgrade to PHP version 7.0.25 | Sep 15, 2022 | Jan 3, 2016 |
| Suse | — | Upgrade libpcre1Upgrade libpcre16-0Upgrade pcre-devel-staticUpgrade libpcrecpp0-32bitUpgrade pcre-develUpgrade sles12-docker-imageUpgrade sles12sp1-docker-imageUpgrade libpcre1-32bitUpgrade libpcreposix0Upgrade pcre-toolsUpgrade libpcrecpp0 | Nov 15, 2016 | Jan 2, 2016 |
| Ubuntu | — | Upgrade libpcre3 | Apr 4, 2016 | Jan 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub