PCRE 'compile_regex()' Function Stack Buffer Overflow Vulnerability

Bugtraq ID:	74924
Class:	Boundary Condition Error
CVE:	CVE-2015-2327 CVE-2015-2328
Remote:	Yes
Local:	No
Published:	May 31 2015 12:00AM
Updated:	Sep 21 2016 01:00PM
Credit:	Wen Guanxing from Venustech
Vulnerable:	PCRE PCRE 8.35 IBM Tealeaf Customer Experience 9.0.2 IBM Tealeaf Customer Experience 9.0.1 IBM Tealeaf Customer Experience 9.0 IBM Tealeaf Customer Experience 9.0.2A IBM Tealeaf Customer Experience 9.0.1A IBM Tealeaf Customer Experience 9.0.0A IBM Tealeaf Customer Experience 9.0 IBM Tealeaf Customer Experience 8.8 IBM Tealeaf Customer Experience 8.7 IBM Tealeaf Customer Experience 8.6 IBM Tealeaf Customer Experience 8.0 IBM PowerKVM 3.1 IBM PowerKVM 2.1 10gen MongoDB 2.6.8 10gen MongoDB 2.6.7 10gen MongoDB 2.5.1 10gen MongoDB 2.4.13 10gen MongoDB 2.4.12 10gen MongoDB 2.3.2 10gen MongoDB 2.3.1 10gen MongoDB 3.0.0-rc8 10gen MongoDB 2.5.0 10gen MongoDB 2.4.5 10gen MongoDB 2.4.4 10gen MongoDB 2.4.3 10gen MongoDB 2.4.2 10gen MongoDB 2.4.1 10gen MongoDB 2.4.0 10gen MongoDB 2.2
Not Vulnerable:	PCRE PCRE 8.36 IBM PowerKVM 3.1.0.2 IBM PowerKVM 2.1.1.3-65.10 10gen MongoDB 3.1 10gen MongoDB 3.0.1 10gen MongoDB 2.6.9 10gen MongoDB 2.4.14

PCRE 'compile_regex()' Function Stack Buffer Overflow Vulnerability

PCRE is prone to a stack-based buffer-overflow vulnerability.

Successful exploits may allow attackers to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

PCRE 8.35 is vulnerable; other versions may also be affected.

PCRE 'compile_regex()' Function Stack Buffer Overflow Vulnerability

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

PCRE 'compile_regex()' Function Stack Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.