Description
PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Remediation
References
Related Vulnerabilities
Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2015-0213)
WordPress Plugin Custom Content Type Manager Remote Code Execution (0.9.8.5)
PHP Use of Uninitialized Resource Vulnerability (CVE-2015-8390)
WordPress Plugin WP-UserAgent Cross-Site Scripting (1.0.5)
SharePoint Improper Input Validation Vulnerability (CVE-2020-1025)