CVE-2015-2327

pcre: infinite recursion compiling pattern with zero-repeated groups that include recursive back reference (8.36/19)

PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 2.0 · 7.5 High EPSS 4.0% KEV · Not listed

Vendors

Pcre Redhat

Products

Perl Compatible Regular Expression Library Enterprise Linux Rhel Software Collections

CVE-2015-8380

pcre: OOB write when pcre_exec() is called with ovecsize of 1 (8.38/10)

The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 2.0 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Fedoraproject Pcre

Products

Fedora Perl Compatible Regular Expression Library

CVE-2015-8381

pcre: Buffer overflow caused by duplicate named references (8.38/36)

The compile_regex function in pcre_compile.c in PCRE before 8.38 and pcre2_compile.c in PCRE2 before 10.2x mishandles the /(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/ and /(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/ patterns, and related patterns with certain group references, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 2.0 · 7.5 High EPSS 5.3% KEV · Not listed

Vendors

Pcre Redhat

Products

Perl Compatible Regular Expression Library Rhel Software Collections

CVE-2015-8382

php: Regular Expression Uninitialized Pointer Information Disclosure Vulnerability (ZDI-CAN-2547)

The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.

CVSS 2.0 · 6.4 Medium EPSS 4.0% KEV · Not listed

Vendors

Pcre

Products

Perl Compatible Regular Expression Library

CVE-2015-8383

pcre: Buffer overflow caused by repeated conditional group (8.38/3)

PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 9.8 Critical EPSS 6.1% KEV · Not listed

Vendors

Fedoraproject Pcre Php and 1 more

Products

Fedora Perl Compatible Regular Expression Library Php and 1 more

CVE-2015-8384

pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4)

PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8392 and CVE-2015-8395.

CVSS 2.0 · 7.5 High EPSS 3.4% KEV · Not listed

Vendors

Pcre Redhat

Products

Perl Compatible Regular Expression Library Rhel Software Collections

CVE-2015-8385

pcre: buffer overflow caused by named forward reference to duplicate group number (8.38/30)

PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 2.0 · 7.5 High EPSS 5.6% KEV · Not listed

Vendors

Oracle Pcre Redhat

Products

Linux Perl Compatible Regular Expression Library Enterprise Linux and 1 more

CVE-2015-8386

pcre: Buffer overflow caused by lookbehind assertion (8.38/6)

PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 9.8 Critical EPSS 6.9% KEV · Not listed

Vendors

Fedoraproject Oracle Pcre and 2 more

Products

Fedora Linux Perl Compatible Regular Expression Library and 3 more

CVE-2015-8387

pcre: Integer overflow in subroutine calls (8.38/8)

PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 7.3 High EPSS 3.6% KEV · Not listed

Vendors

Fedoraproject Pcre Php

Products

Fedora Perl Compatible Regular Expression Library Php

CVE-2015-8388

pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis (8.38/18)

PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 2.0 · 7.5 High EPSS 6.6% KEV · Not listed

Vendors

Oracle Pcre Redhat

Products

Linux Perl Compatible Regular Expression Library Enterprise Linux and 1 more

CVE-2015-8389

pcre: infinite recursion in JIT compiler when processing certain patterns (8.38/21)

PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 9.8 Critical EPSS 3.9% KEV · Not listed

Vendors

Fedoraproject Pcre Php

Products

Fedora Perl Compatible Regular Expression Library Php

CVE-2015-8390

pcre: uninitialized memory read triggered by malformed posix character class (8.38/22)

PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 9.8 Critical EPSS 4.7% KEV · Not listed

Vendors

Fedoraproject Pcre Php

Products

Fedora Perl Compatible Regular Expression Library Php

CVE-2015-8392

pcre: buffer overflow caused by patterns with duplicated named groups with (?| (8.38/27)

PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.

CVSS 2.0 · 7.5 High EPSS 3.6% KEV · Not listed

Vendors

Pcre Redhat

Products

Perl Compatible Regular Expression Library Rhel Software Collections

CVE-2015-8393

pcre: pcregrep -q is not always quiet (8.38/28)

pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Fedoraproject Pcre Php

Products

Fedora Perl Compatible Regular Expression Library Php

CVE-2015-8394

pcre: Integer overflow caused by missing check for certain conditions (8.38/31)

PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 9.8 Critical EPSS 4.8% KEV · Not listed

Vendors

Pcre Php

Products

Perl Compatible Regular Expression Library Php

CVE-2015-8395

pcre: Buffer overflow caused by duplicate named references (8.38/36)

PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8392.

CVSS 2.0 · 7.5 High EPSS 3.5% KEV · Not listed

Vendors

Pcre Redhat

Products

Perl Compatible Regular Expression Library Rhel Software Collections