Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS-2023-1767

Related Vulnerabilities: CVE-2015-5073   CVE-2015-8390   CVE-2015-8394  

Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis. (CVE-2015-5073) PCRE before 8.38 mishandles the [: and \ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. (CVE-2015-8390) PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. (CVE-2015-8394)

Source

ALAS-2023-1767

Amazon Linux AMI Security Advisory: ALAS-2023-1767
Advisory Release Date: 2023-06-05 16:39 Pacific
Advisory Updated Date: 2023-06-08 23:38 Pacific
Severity: Medium
Issue Overview:

Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis. (CVE-2015-5073)

PCRE before 8.38 mishandles the [: and \ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. (CVE-2015-8390)

PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. (CVE-2015-8394)


Affected Packages:

pcre


Issue Correction:
Run yum update pcre to update your system.

New Packages:
i686:
    pcre-static-8.21-7.9.amzn1.i686
    pcre-devel-8.21-7.9.amzn1.i686
    pcre-debuginfo-8.21-7.9.amzn1.i686
    pcre-tools-8.21-7.9.amzn1.i686
    pcre-8.21-7.9.amzn1.i686

src:
    pcre-8.21-7.9.amzn1.src

x86_64:
    pcre-8.21-7.9.amzn1.x86_64
    pcre-devel-8.21-7.9.amzn1.x86_64
    pcre-static-8.21-7.9.amzn1.x86_64
    pcre-debuginfo-8.21-7.9.amzn1.x86_64
    pcre-tools-8.21-7.9.amzn1.x86_64

Additional References

Red Hat: CVE-2015-5073, CVE-2015-8390, CVE-2015-8394

Mitre: CVE-2015-5073, CVE-2015-8390, CVE-2015-8394

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started