Description

The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Remediation

References

CVE-2015-8391

Related Vulnerabilities

WordPress Plugin All-in-One Event Calendar Multiple Vulnerabilities (1.10-standard)

Moodle Improper Input Validation Vulnerability (CVE-2011-4302)

Oracle Database Server CVE-2009-1020 Vulnerability (CVE-2009-1020)

WordPress Plugin Client Invoicing by Sprout Invoices-Easy Estimates and Invoices for WordPress Cross-Site Scripting (19.9.6)

Ruby on Rails Use of Externally-Controlled Format String Vulnerability (CVE-2013-4389)

Severity

Critical

Classification

CVE-2015-8391 CWE-119 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities