CVE-2015-8382

2015-12-0100:00:00

ubuntu.com

0.05 Low

EPSS

Percentile

92.8%

JSON

The match function in pcre_exec.c in PCRE before 8.37 mishandles the
/(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/
pattern and related patterns involving (*ACCEPT), which allows remote
attackers to obtain sensitive information from process memory or cause a
denial of service (partially initialized memory and application crash) via
a crafted regular expression, as demonstrated by a JavaScript RegExp object
encountered by Konqueror, aka ZDI-CAN-2547.

Bugs

Notes

Author	Note
tyhicks	Issue affects PCRE3 only Marking ‘low’ since it requires PCRE to operate on untrusted regular expressions which is not very likely
mdeslaur	794589-information-disclosure.patch in jessie

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchpcre3< 8.12-4ubuntu0.2UNKNOWN
ubuntu14.04noarchpcre3< 1:8.31-2ubuntu2.2UNKNOWN
ubuntu15.10noarchpcre3< 2:8.35-7.1ubuntu1.3UNKNOWN