5.5
CVSSv3

CVE-2015-2326

Published: 14/01/2020 Updated: 19/01/2023
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Vulnerability Summary

The pcre_compile2 function in PCRE prior to 8.37 allows context-dependent malicious users to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

pcre pcre

opensuse opensuse 13.1

opensuse opensuse 13.2

mariadb mariadb

php php

Vendor Advisories

Synopsis Moderate: rh-php56 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for rh-php56, rh-php56-php, and rh-php56-php-pear is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Mo ...
PCRE could be made to crash or run programs if it processed a specially-crafted regular expression ...
PCRE could be made to crash or run programs if it processed a specially-crafted regular expression ...
Debian Bug report logs - #781795 pcre3: CVE-2015-2325: heap buffer overflow in compile_branch() Package: src:pcre3; Maintainer for src:pcre3 is Matthew Vernon <matthew@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 3 Apr 2015 09:33:02 UTC Severity: important Tags: fixed-upstream, patch ...
Debian Bug report logs - #809706 pcre3: CVE-2016-1283 Package: src:pcre3; Maintainer for src:pcre3 is Matthew Vernon <matthew@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 3 Jan 2016 06:37:17 UTC Severity: important Tags: fixed-upstream, patch, security, upstream Found in version pcr ...
Debian Bug report logs - #794589 pcre3: CVE-2015-8382: pcre_exec does not fill offsets for certain regexps Package: src:pcre3; Maintainer for src:pcre3 is Matthew Vernon <matthew@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 4 Aug 2015 17:57:02 UTC Severity: important Tags: patch, sec ...
Debian Bug report logs - #783285 pcre3: CVE-2015-2326: heap buffer overflow in pcre_compile2() Package: src:pcre3; Maintainer for src:pcre3 is Matthew Vernon <matthew@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 25 Apr 2015 08:39:02 UTC Severity: important Tags: patch, security, upstr ...
Debian Bug report logs - #787433 pcre3: CVE-2015-3210: heap buffer overflow in pcre_compile2() / compile_regex() Package: src:pcre3; Maintainer for src:pcre3 is Matthew Vernon <matthew@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 1 Jun 2015 17:27:01 UTC Severity: important Tags: fixe ...
Upstream reports that several bugs have been fixed as well as several security issues into some bundled libraries (CVE-2015-3414, CVE-2015-3415, CVE-2015-3416, CVE-2015-2325 and CVE-2015-2326) All PHP 56 users are encouraged to upgrade to this version Please see the <a href="phpnet/ChangeLog-5php#5610">upstream release notes&lt ...
Upstream reports that several bugs have been fixed as well as several security issues into some bundled libraries (CVE-2015-3414, CVE-2015-3415, CVE-2015-3416, CVE-2015-2325 and CVE-2015-2326) All PHP 55 users are encouraged to upgrade to this version Please see the <a href="phpnet/ChangeLog-5php#5526">upstream release notes&lt ...
An integer underflow flaw leading to out-of-bounds memory access was found in the way PHP's Phar extension parsed Phar archives A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened (CVE-2015-4021) An integer overflow flaw leading to a heap based buffer overflow was found in the way PHP's FTP extens ...
An integer underflow flaw leading to out-of-bounds memory access was found in the way PHP's Phar extension parsed Phar archives A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened (CVE-2015-4021) An integer overflow flaw leading to a heap based buffer overflow was found in the way PHP's FTP extens ...
SecurityCenter is potentially impacted by several vulnerabilities in PHP that were recently disclosed and fixed Note that due to the time involved in doing a full analysis of each issue, Tenable has opted to patch the included version of PHP as a precaution, and to save time CVE-2015-4025: PHP Multiple NULL Byte Injection Filter Bypass Weaknesse ...