Skip to content
OpenAdvisories
Unscored USN-2943-1 25 CVEs

pcre3 vulnerabilities

Published Mar 29, 2016 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PCRE incorrectly handled certain regular
expressions. A remote attacker could use this issue to cause applications
using PCRE to crash, resulting in a denial of service, or possibly execute
arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS pcre3 1:8.31-2ubuntu2.2

Vulnerabilities 25

  • Unscored —
    CVE-2014-9769

    pcre_jit_compile.c in PCRE 8.35 does not properly use table jumps to optimize nested alternatives, which allows remote …

    pcre3 Debian
  • Unscored —
    CVE-2015-2325

    The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a d…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-2326

    The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-2327

    PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive ba…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-2328

    PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows rem…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-3210

    Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code …

    pcre3 Debian
  • Unscored —
    CVE-2015-5073

    Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attacke…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8380

    The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remot…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8381

    The compile_regex function in pcre_compile.c in PCRE before 8.38 and pcre2_compile.c in PCRE2 before 10.2x mishandles t…

    pcre3 Debian
  • Unscored —
    CVE-2015-8382

    The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcd…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8383

    PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of ser…

    pcre3 Debian
  • Unscored —
    CVE-2015-8384

    PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back refere…

    pcre3 Debian
  • Unscored —
    CVE-2015-8385

    PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, wh…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8386

    PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows r…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8387

    PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to caus…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8388

    PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing paren…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8389

    PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a …

    pcre3 Debian
  • Unscored —
    CVE-2015-8390

    PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a den…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8391

    The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote atta…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8392

    PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of …

    pcre3 Debian
  • Unscored —
    CVE-2015-8393

    pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain se…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8394

    PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a den…

    pcre3 pcre3 Debian Ubuntu
  • Unscored —
    CVE-2015-8395

    PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly …

    pcre3 Debian
  • Unscored —
    CVE-2016-1283

    The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((…

    php7 pcre3 php5 pcre Debian Alpine
  • Unscored —
    CVE-2016-3191

    The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishand…

    pcre3 pcre3 pcre2 pcre Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2014-9769
  • report
    https://ubuntu.com/security/CVE-2015-2325
  • report
    https://ubuntu.com/security/CVE-2015-2326
  • report
    https://ubuntu.com/security/CVE-2015-2327
  • report
    https://ubuntu.com/security/CVE-2015-2328
  • report
    https://ubuntu.com/security/CVE-2015-3210
  • report
    https://ubuntu.com/security/CVE-2015-5073
  • report
    https://ubuntu.com/security/CVE-2015-8380
  • report
    https://ubuntu.com/security/CVE-2015-8381
  • report
    https://ubuntu.com/security/CVE-2015-8382
  • report
    https://ubuntu.com/security/CVE-2015-8383
  • report
    https://ubuntu.com/security/CVE-2015-8384
  • report
    https://ubuntu.com/security/CVE-2015-8385
  • report
    https://ubuntu.com/security/CVE-2015-8386
  • report
    https://ubuntu.com/security/CVE-2015-8387
  • report
    https://ubuntu.com/security/CVE-2015-8388
  • report
    https://ubuntu.com/security/CVE-2015-8389
  • report
    https://ubuntu.com/security/CVE-2015-8390
  • report
    https://ubuntu.com/security/CVE-2015-8391
  • report
    https://ubuntu.com/security/CVE-2015-8392
  • report
    https://ubuntu.com/security/CVE-2015-8393
  • report
    https://ubuntu.com/security/CVE-2015-8394
  • report
    https://ubuntu.com/security/CVE-2015-8395
  • report
    https://ubuntu.com/security/CVE-2016-1283
  • report
    https://ubuntu.com/security/CVE-2016-3191