CVE-2015-8380

2015-12-0201:59:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2015-8380

pcre

denial of service

heap-based buffer overflow

nvd

security vulnerability

regular expression

remote attack

9.6 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.067 Low

EPSS

Percentile

93.8%

JSON

The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CPENameOperatorVersion
pcre:perl_compatible_regular_expression_librarypcre perl compatible regular expression libraryle8.37
fedoraproject:fedorafedoraproject fedoraeq22