CVE-2015-3210

EUVD-2015-3273
Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/, a different vulnerability than CVE-2015-8384.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
Affected Products (NVD)
VendorProductVersion
pcrepcre2
10.10
pcrepcre
8.34
pcrepcre
8.35
pcrepcre
8.36
pcrepcre
8.37
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pcre3
bookworm
2:8.39-15
fixed
bullseye
2:8.39-13
fixed
sid
2:8.39-15.1
fixed
squeeze
not-affected
wheezy
not-affected
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pcre3
precise
not-affected
trusty
not-affected
utopic
ignored
vivid
Fixed 2:8.35-3.3ubuntu1.1
released
wily
Fixed 2:8.35-7.1ubuntu1.3
released
Common Weakness Enumeration
References
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.openwall.com/lists/oss-security/2015/06/01/7
http://www.openwall.com/lists/oss-security/2015/12/02/11
http://www.securityfocus.com/bid/74934
https://access.redhat.com/errata/RHSA-2016:1132
https://bugs.exim.org/show_bug.cgi?id=1636
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.openwall.com/lists/oss-security/2015/06/01/7
http://www.openwall.com/lists/oss-security/2015/12/02/11
http://www.securityfocus.com/bid/74934
https://access.redhat.com/errata/RHSA-2016:1132
https://bugs.exim.org/show_bug.cgi?id=1636