UBUNTU-CVE-2015-2326

The pcrecompile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service out-of-bounds read via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by...

MongoDB Patches Remote Denial-of-Service Vulnerability

MongoDB, a popular NoSQL database used in big data and heavy analytics environments, has patched a serious denial-of-service vulnerability that is remotely exploitable. Companies using the default installation of MongoDB, which does not require authentication to access the database, are urged to...

PCRE Denial of Service Vulnerability (CNVD-2015-02117)

PCRE Perl Compatible Regular Expressions is a Perl library that includes a library of perl-compatible regular expressions. A denial of service vulnerability exists in PCRE 8.36 and earlier versions, which can be exploited by a remote attacker to cause stack exhaustion leading to a denial of servi...

CVE-2015-2305

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library aka rxspencer alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a...

CVE-2015-2305

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library aka rxspencer alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a...

DEBIAN-CVE-2015-2305

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library aka rxspencer alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a...

Integer overflow

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library aka rxspencer alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a...

CVE-2015-2305

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library aka rxspencer alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a...

CVE-2015-2305

CVE-2015-2305 describes an integer/heap overflow in the Henry Spencer BSD regex library (rxspencer), specifically in regcomp on 32-bit platforms. The issue can be triggered by a very large regular expression, potentially allowing context-dependent attackers to execute arbitrary code via a heap-ba...

CVE-2015-2305

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library aka rxspencer alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a...

CVE-2015-2305

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library aka rxspencer alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a...

UBUNTU-CVE-2015-2305

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library aka rxspencer alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a...

PHP 5.5.x < 5.5.23 Multiple Vulnerabilities

According to its banner, the version of PHP 5.5.x installed on the remote host is prior to 5.5.23. It is, therefore, affected by multiple vulnerabilities : - A use-after-free error exists related to function 'unserialize', which can allow a remote attacker to execute arbitrary code. Note that thi...

Adobe Flash Player PCRE Regex Logic Error

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Adobe Flash Player PCRE Regex Vulnerability", 'Description' = %q This module exploits a vulnerability found in Adobe Flash Player. A...

Adobe Flash Player - PCRE Regex (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Adobe Flash Player PCRE Regex Vulnerability", 'Description' = %q This module exploits a vulnerability found in Adobe Flash Player. A...

pcre: incorrect handling of zero-repeat assertion conditions

A flaw was found in the way PCRE handled certain malformed regular expressions. This issue could cause an application for example, Konqueror linked against PCRE to crash while parsing malicious regular expressions...

Henry Spencer Regex Library 'regcomp.c' Heap-Based Buffer Overflow Vulnerability

Henry Spencer Regex Library is a set of Canadian software developer Henry Spencer developed a set of regular expression software library written in C language. A buffer overflow vulnerability exists in Henry Spencer Regex Library. An attacker could use this vulnerability to perform unauthorized...

Internet Bug Bounty: Heap overflow in H. Spencer’s regex library on 32 bit systems

The IBB's programs provide a great incentive for me to find vulnerabilities in open source software. With this one I set out to find a vulnerability in PHP and discovered that the vulnerability that I found exists in a wider constellation of applications, including BSD libc's. IBB's Alex Rice's...

Henry Spencer regular expressions (regex) library contains a heap overflow vulnerability

Overview A regular expressions C library originally written by Henry Spencer is vulnerable to a heap overflow in some circumstances. Description CWE-122: Heap-based Buffer Overflow From the researcher, the variable len that holds the length of a regular expression string is "enlarged to such an...

(^Exploiting)\s*(CVE-2015-0318)\s*(in)\s*(Flash$)

Posted by Mark Brand, Irregular Expressionist So; issue 199/PSIRT-3161/CVE-2015-0318. Quick summary - it’s a bug in the PCRE regex engine as used in Flash. Note that the published version of the avmplus code is significantly out of date; there are a number of other vulnerabilities present that ha...