Vulnerabilities > Pcre > Perl Compatible Regular Expression Library

DATE CVE VULNERABILITY TITLE RISK
2015-12-02 CVE-2015-8395 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Pcre Perl Compatible Regular Expression Library 8.36/8.37
PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8392.
network
low complexity
pcre CWE-119
7.5
2015-12-02 CVE-2015-8394 Integer Overflow or Wraparound vulnerability in multiple products
PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
network
low complexity
pcre php CWE-190
critical
9.8
2015-12-02 CVE-2015-8393 Information Exposure vulnerability in multiple products
pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client.
network
low complexity
pcre fedoraproject php CWE-200
7.5
2015-12-02 CVE-2015-8392 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Pcre Perl Compatible Regular Expression Library 8.36/8.37
PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.
network
low complexity
pcre CWE-119
7.5
2015-12-02 CVE-2015-8390 Use of Uninitialized Resource vulnerability in multiple products
PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
network
low complexity
pcre fedoraproject php CWE-908
critical
9.8
2015-12-02 CVE-2015-8389 Incorrect Regular Expression vulnerability in multiple products
PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
network
low complexity
pcre fedoraproject php CWE-185
critical
9.8
2015-12-02 CVE-2015-8388 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
network
low complexity
oracle pcre CWE-119
7.5
2015-12-02 CVE-2015-8387 Integer Overflow or Wraparound vulnerability in multiple products
PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
network
low complexity
pcre fedoraproject php CWE-190
7.3
2015-12-02 CVE-2015-8386 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
network
low complexity
pcre fedoraproject oracle php CWE-119
critical
9.8
2015-12-02 CVE-2015-8385 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
network
low complexity
oracle pcre CWE-119
7.5