PCRE 'match()' Function Stack Buffer Overflow Vulnerability

Bugtraq ID:	75018
Class:	Boundary Condition Error
CVE:	CVE-2015-3217
Remote:	Yes
Local:	No
Published:	Jun 03 2015 12:00AM
Updated:	Jul 26 2016 06:00PM
Credit:	Wen Guanxing
Vulnerable:	PCRE PCRE2 10.10 PCRE PCRE 8.37 PCRE PCRE 8.36 PCRE PCRE 8.35 PCRE PCRE 8.34 PCRE PCRE 8.33 Oracle Solaris 11.3 Oracle Solaris 11.2 IBM PowerKVM 3.1 IBM PowerKVM 2.1
Not Vulnerable:	Oracle Solaris 11.3 SRU 5.6 IBM PowerKVM 3.1.0.2 IBM PowerKVM 2.1.1.3-65.10

PCRE 'match()' Function Stack Buffer Overflow Vulnerability

PCRE is prone to a stack-based buffer-overflow vulnerability.

Successful exploits may allow attackers to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

PCRE 'match()' Function Stack Buffer Overflow Vulnerability

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

PCRE 'match()' Function Stack Buffer Overflow Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

PCRE 'match()' Function Stack Buffer Overflow Vulnerability

References:

• PCRE Homepage (PCRE)
  
• CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() (Seclists.org)
  
• isg3T1023886: Security Bulletin: Multiple vulnerabilities in PCRE affect PowerKV (IBM)
  
• Oracle Solaris Third Party Bulletin - January 2016 (Oracle)
  
• Oracle Solaris Third Party Bulletin - July 2015 (Oracle)
  
• PCRE Library Call Stack Overflow Vulnerability in match() (bugs.exim.org)