Skip to content
OpenAdvisories
High ELSA-2016-1025 8 CVEs

Important: pcre security update (Oracle Linux 7)

Published May 11, 2016 · Updated May 11, 2016

Ecosystem: Oracle Linux

Summary

[8.32-15.1]
- Fix CVE-2015-2328 (infinite recursion compiling pattern with recursive
reference in a group with indefinite repeat) (bug #1330508)
- Fix CVE-2015-8385 (buffer overflow caused by named forward reference to
duplicate group number) (bug #1330508)
- Fix CVE-2015-8386 (buffer overflow caused by lookbehind assertion)
(bug #1330508)
- Fix CVE-2015-3217 (stack overflow caused by mishandled group empty match)
(bug #1330508)
- Fix CVE-2015-5073 and CVE-2015-8388 (buffer overflow for forward reference
within backward assertion with excess closing parenthesis) (bug #1330508)
- Fix CVE-2015-8391 (inefficient posix character class syntax check)
(bug #1330508)
- Fix CVE-2016-3191 (workspace overflow for (*ACCEPT) with deeply nested
parentheses) (bug #1330508)

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 7 pcre 0:8.32-15.el7_2.1
Oracle Linux · 7 pcre-devel 0:8.32-15.el7_2.1
Oracle Linux · 7 pcre-static 0:8.32-15.el7_2.1
Oracle Linux · 7 pcre-tools 0:8.32-15.el7_2.1

Vulnerabilities 8

  • Unscored —
    CVE-2015-2328

    PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows rem…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-3217

    PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to ca…

    pcre3 Debian
  • Unscored —
    CVE-2015-5073

    Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attacke…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8385

    PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, wh…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8386

    PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows r…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8388

    PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing paren…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8391

    The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote atta…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2016-3191

    The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishand…

    pcre3 pcre3 pcre2 pcre Debian Ubuntu Alpine