CVE-2015-2326 — Out-of-bounds Read in Pcre

CWE-125 — Out-of-bounds Read10 documents8 sources
Severity
5.5MEDIUMNVD
OSV5.0
EPSS
0.6%
top 31.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
MariadbPcrePHP+2 more
Timeline
PublishedJan 14
Latest updateMay 24

Description

The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶NVDpcre/pcre< 8.37
▶debiandebian/pcre3< pcre3 2:8.35-7.2 (bookworm)
▶NVDphp/php5.4.0 — 5.4.41+2
▶NVDmariadb/mariadb10.0.0 — 10.0.18
▶NVDopensuse/opensuse13.1, 13.2+1

🔴Vulnerability Details

3
GHSA
GHSA-m793-2mj8-wj8q: The pcre_compile2 function in PCRE before 8↗2022-05-24
▶
OSV
CVE-2015-2326: The pcre_compile2 function in PCRE before 8↗2020-01-14
▶
OSV
pcre3 vulnerabilities↗2015-07-29
▶

📋Vendor Advisories

4
Ubuntu
PCRE vulnerabilities↗2016-03-29
▶
Ubuntu
PCRE vulnerabilities↗2015-07-29
▶
Red Hat
pcre: heap buffer over-read in pcre_compile2() (8.37/23)↗2015-03-23
▶
Debian
CVE-2015-2326: pcre3 - The pcre_compile2 function in PCRE before 8.37 allows context-dependent attacker...↗2015
▶

🕵️Threat Intelligence

1
Tenable
[R4] SecurityCenter 5.0.0.1 Affected by Third-party Library↗2015-06-15
▶

💬Community

1
Bugzilla
CVE-2015-2326 pcre: heap buffer over-read in pcre_compile2() (8.37/23)↗2015-03-30
▶
CVE-2015-2326 — Out-of-bounds Read in Pcre | cvebase