CVE-2015-8390

PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
Affected Products (NVD)
VendorProductVersion
pcreperl_compatible_regular_expression_library
𝑥
≤ 8.37
phpphp
5.5.0 ≤
𝑥
< 5.5.32
phpphp
5.6.0 ≤
𝑥
< 5.6.18
phpphp
7.0.0 ≤
𝑥
< 7.0.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pcre3
bookworm
2:8.39-15
fixed
bullseye
2:8.39-13
fixed
sid
2:8.39-15.1
fixed
squeeze
no-dsa
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pcre2
precise
dne
trusty
dne
vivid
dne
wily
dne
xenial
not-affected
yakkety
not-affected
zesty
not-affected
pcre3
precise
Fixed 8.12-4ubuntu0.2
released
trusty
Fixed 1:8.31-2ubuntu2.2
released
vivid
ignored
wily
Fixed 2:8.35-7.1ubuntu1.3
released
xenial
not-affected
yakkety
not-affected
zesty
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libpcre1
suse enterprise sap 12 SP1
8.39-7.1
fixed
suse enterprise sap 12 SP2
8.39-7.1
fixed
suse enterprise server 12
8.39-7.1
fixed
suse enterprise server 12 SP1
8.39-7.1
fixed
suse enterprise server 12 SP2
8.39-7.1
fixed
libpcre1-32bit
suse enterprise sap 12 SP1
8.39-7.1
fixed
suse enterprise sap 12 SP2
8.39-7.1
fixed
suse enterprise server 12
8.39-7.1
fixed
suse enterprise server 12 SP1
8.39-7.1
fixed
suse enterprise server 12 SP2
8.39-7.1
fixed
libpcre16-0
suse enterprise sap 12 SP1
8.39-7.1
fixed
suse enterprise sap 12 SP2
8.39-7.1
fixed
suse enterprise server 12
8.39-7.1
fixed
suse enterprise server 12 SP1
8.39-7.1
fixed
suse enterprise server 12 SP2
8.39-7.1
fixed
libpcrecpp0
suse enterprise desktop 12 SP1
8.39-7.1
fixed
suse enterprise desktop 12 SP2
8.39-7.1
fixed
suse enterprise sap 12 SP1
8.39-7.1
fixed
suse enterprise sap 12 SP2
8.39-7.1
fixed
suse enterprise sap 12 SP5
8.39-7.1
fixed
suse enterprise server 12 SP1
8.39-7.1
fixed
suse enterprise server 12 SP2
8.39-7.1
fixed
suse enterprise server 12 SP5
8.39-7.1
fixed
suse enterprise workstation 12 SP1
8.39-7.1
fixed
suse enterprise workstation 12 SP2
8.39-7.1
fixed
suse enterprise workstation 12 SP5
8.39-7.1
fixed
libpcrecpp0-32bit
suse enterprise desktop 12 SP1
8.39-7.1
fixed
suse enterprise desktop 12 SP2
8.39-7.1
fixed
suse enterprise sap 12 SP1
8.39-7.1
fixed
suse enterprise sap 12 SP2
8.39-7.1
fixed
suse enterprise sap 12 SP5
8.39-7.1
fixed
suse enterprise server 12 SP1
8.39-7.1
fixed
suse enterprise server 12 SP2
8.39-7.1
fixed
suse enterprise server 12 SP5
8.39-7.1
fixed
suse enterprise workstation 12 SP1
8.39-7.1
fixed
suse enterprise workstation 12 SP2
8.39-7.1
fixed
suse enterprise workstation 12 SP5
8.39-7.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
glib2
Amazon Linux 1
0:2.36.3-5.26.amzn1
fixed
Amazon Linux 2
0:2.56.1-9.amzn2.0.6
fixed
glib2-debuginfo
Amazon Linux 1
0:2.36.3-5.26.amzn1
fixed
Amazon Linux 2
0:2.56.1-9.amzn2.0.6
fixed
glib2-devel
Amazon Linux 1
0:2.36.3-5.26.amzn1
fixed
Amazon Linux 2
0:2.56.1-9.amzn2.0.6
fixed
glib2-doc
Amazon Linux 1
0:2.36.3-5.26.amzn1
fixed
Amazon Linux 2
0:2.56.1-9.amzn2.0.6
fixed
glib2-fam
Amazon Linux 1
0:2.36.3-5.26.amzn1
fixed
Amazon Linux 2
0:2.56.1-9.amzn2.0.6
fixed
glib2-static
Amazon Linux 2
0:2.56.1-9.amzn2.0.6
fixed
glib2-tests
Amazon Linux 2
0:2.56.1-9.amzn2.0.6
fixed
pcre
Amazon Linux 1
0:8.21-7.9.amzn1
fixed
Amazon Linux 2
0:8.32-17.amzn2.0.3
fixed
pcre-debuginfo
Amazon Linux 1
0:8.21-7.9.amzn1
fixed
Amazon Linux 2
0:8.32-17.amzn2.0.3
fixed
pcre-devel
Amazon Linux 1
0:8.21-7.9.amzn1
fixed
Amazon Linux 2
0:8.32-17.amzn2.0.3
fixed
pcre-static
Amazon Linux 1
0:8.21-7.9.amzn1
fixed
Amazon Linux 2
0:8.32-17.amzn2.0.3
fixed
pcre-tools
Amazon Linux 1
0:8.21-7.9.amzn1
fixed
Amazon Linux 2
0:8.32-17.amzn2.0.3
fixed
Common Weakness Enumeration
References
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html
http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
http://www.openwall.com/lists/oss-security/2015/11/29/1
http://www.securityfocus.com/bid/82990
https://bto.bluecoat.com/security-advisory/sa128
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
https://security.gentoo.org/glsa/201607-02
https://security.netapp.com/advisory/ntap-20230216-0002/
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html
http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
http://www.openwall.com/lists/oss-security/2015/11/29/1
http://www.securityfocus.com/bid/82990
https://bto.bluecoat.com/security-advisory/sa128
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
https://security.gentoo.org/glsa/201607-02
https://security.netapp.com/advisory/ntap-20230216-0002/