Fluid Attacks Database

Description

PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	pcre3	>=0 <2:8.35-7.2	2:8.35-7.2
debian 11	pcre3	>=0 <2:8.35-7.2	2:8.35-7.2
rpm rhel7	glib2	-	-
rpm rhel7	pcre	<0:8.32-15.el7_2.1	0:8.32-15.el7_2.1

Aliases

1. CVE-2015-23282. NVD-2015-23283. OSV-DEBIAN-2015-23284. OSV-2015-23285. SECURITY-TRACKER-CVE-2015-2328

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.