CVE-2015-2325 — Out-of-bounds Read in Pcre

CWE-125 — Out-of-bounds ReadCWE-787 — Out-of-bounds WriteCWE-122 — Heap-based Buffer Overflow11 documents9 sources
Severity
7.8HIGHNVD
OSV5.0
EPSS
0.4%
top 41.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
MariadbPcrePHP+2 more
Timeline
PublishedJan 14
Latest updateFeb 27

Description

The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶NVDpcre/pcre< 8.37
▶debiandebian/pcre3< pcre3 2:8.35-7.2 (bookworm)
▶NVDphp/php5.4.0 — 5.4.41+2
▶NVDmariadb/mariadb< 10.0.18
▶NVDopensuse/opensuse13.1, 13.2+1

🔴Vulnerability Details

3
GHSA
GHSA-mwr9-2r49-jwhg: The compile_branch function in PCRE before 8↗2022-05-24
▶
OSV
CVE-2015-2325: The compile_branch function in PCRE before 8↗2020-01-14
▶
OSV
pcre3 vulnerabilities↗2015-07-29
▶

📋Vendor Advisories

4
Ubuntu
PCRE vulnerabilities↗2016-03-29
▶
Ubuntu
PCRE vulnerabilities↗2015-07-29
▶
Red Hat
pcre: heap buffer overflow in compile_branch()↗2015-03-23
▶
Debian
CVE-2015-2325: pcre3 - The compile_branch function in PCRE before 8.37 allows context-dependent attacke...↗2015
▶

🕵️Threat Intelligence

1
Tenable
[R4] SecurityCenter 5.0.0.1 Affected by Third-party Library↗2015-06-15
▶

📄Research Papers

1
arXiv
Towards the Systematic Testing of Regular Expression Engines↗2026-02-27
▶

💬Community

1
Bugzilla
CVE-2015-2325 pcre: heap buffer overflow in compile_branch()↗2015-03-30
▶
CVE-2015-2325 — Out-of-bounds Read in Pcre | cvebase