CVE-2015-3217
Summary
| CVE | CVE-2015-3217 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2016-12-13 16:59:00 UTC |
|---|
| Updated | 2018-05-18 01:29:00 UTC |
|---|
| Description | PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| IBM Security Bulletin: Multiple vulnerabilities in PCRE affect PowerKVM - United States |
CONFIRM |
www-01.ibm.com |
Third Party Advisory |
| PCRE 'match()' Function Stack Buffer Overflow Vulnerability |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| 1228283 – (CVE-2015-3217) CVE-2015-3217 pcre: stack overflow caused by mishandled group empty match (8.38/11) |
CONFIRM |
bugzilla.redhat.com |
Issue Tracking |
| [pcre] Revision 1566 |
CONFIRM |
vcs.pcre.org |
Patch |
| Oracle Linux Bulletin - April 2016 |
CONFIRM |
www.oracle.com |
|
| oss-security - CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() |
MLIST |
www.openwall.com |
Mailing List |
| Red Hat Customer Portal |
REDHAT |
access.redhat.com |
|
| Red Hat Customer Portal |
REDHAT |
rhn.redhat.com |
|
| Red Hat Customer Portal |
REDHAT |
rhn.redhat.com |
|
| Bug 1638 – PCRE Library Call Stack Overflow Vulnerability in match() |
CONFIRM |
bugs.exim.org |
Exploit, Issue Tracking, Vendor Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 670287 EulerOS Security Update for glib2 (EulerOS-SA-2021-1789)
