CVE-2015-8393 — Sensitive Information Exposure in Perl Compatible Regular Expression Library

CWE-200 — Sensitive Information Exposure12 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.7%
top 27.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
PHPPcre Perl Compatible Regular Expression LibraryFedoraproject Fedora
Timeline
PublishedDec 2
Latest updateMay 17

Description

pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDphp/php5.5.0 — 5.5.32+2

Also affects: Fedora 22

🔴Vulnerability Details

3
GHSA
GHSA-795f-fr55-w3f9: pcregrep in PCRE before 8↗2022-05-17
▶
OSV
CVE-2015-8393: pcregrep in PCRE before 8↗2015-12-02
▶
CVEList
CVE-2015-8393: pcregrep in PCRE before 8↗2015-12-02
▶

📋Vendor Advisories

3
Ubuntu
PCRE vulnerabilities↗2016-03-29
▶
Red Hat
pcre: pcregrep -q is not always quiet (8.38/28)↗2015-11-23
▶
Debian
CVE-2015-8393: pcre3 - pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which mi...↗2015
▶

💬Community

5
Bugzilla
CVE-2015-8393 mingw-pcre: pcre: Information leak when running pcgrep -q on crafted binary [epel-7]↗2015-12-02
▶
Bugzilla
CVE-2015-8393 mingw-pcre: pcre: Information leak when running pcgrep -q on crafted binary [fedora-all]↗2015-12-02
▶
Bugzilla
CVE-2015-8393 pcre: Information leak when running pcgrep -q on crafted binary [fedora-all]↗2015-12-02
▶
Bugzilla
CVE-2015-8393 glib2: pcre: Information leak when running pcgrep -q on crafted binary [fedora-all]↗2015-12-02
▶
Bugzilla
CVE-2015-8393 pcre: pcregrep -q is not always quiet (8.38/28)↗2015-12-02
▶
CVE-2015-8393 — Sensitive Information Exposure | cvebase