CVE-2015-8387 — Integer Overflow or Wraparound in Perl Compatible Regular Expression Library

CWE-190 — Integer Overflow or Wraparound12 documents8 sources
Severity
7.3HIGHNVD
EPSS
1.4%
top 19.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
PHPPcre Perl Compatible Regular Expression LibraryFedoraproject Fedora
Timeline
PublishedDec 2
Latest updateMay 17

Description

PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 3.9 | Impact: 3.4

Affected Packages2 packages

▶NVDphp/php5.5.0 — 5.5.32+2

Also affects: Fedora 22

🔴Vulnerability Details

3
GHSA
GHSA-gjfv-m56f-jm68: PCRE before 8↗2022-05-17
▶
OSV
CVE-2015-8387: PCRE before 8↗2015-12-02
▶
CVEList
CVE-2015-8387: PCRE before 8↗2015-12-02
▶

📋Vendor Advisories

3
Ubuntu
PCRE vulnerabilities↗2016-03-29
▶
Red Hat
pcre: Integer overflow in subroutine calls (8.38/8)↗2015-11-23
▶
Debian
CVE-2015-8387: pcre3 - PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls...↗2015
▶

💬Community

5
Bugzilla
CVE-2015-8387 pcre: Integer overflow in subroutine calls [fedora-all]↗2015-12-02
▶
Bugzilla
CVE-2015-8387 mingw-pcre: pcre: Integer overflow in subroutine calls [fedora-all]↗2015-12-02
▶
Bugzilla
CVE-2015-8387 glib2: pcre: Integer overflow in subroutine calls [fedora-all]↗2015-12-02
▶
Bugzilla
CVE-2015-8387 pcre: Integer overflow in subroutine calls (8.38/8)↗2015-12-02
▶
Bugzilla
CVE-2015-8387 mingw-pcre: pcre: Integer overflow in subroutine calls [epel-7]↗2015-12-02
▶
CVE-2015-8387 — Integer Overflow or Wraparound | cvebase