Description

PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Remediation

References

CVE-2015-8390

Related Vulnerabilities

Oracle HTTP Server Out-of-bounds Read Vulnerability (CVE-2021-35940)

IBM WebSEAL Improper Restriction of XML External Entity Reference Vulnerability (CVE-2019-4707)

WordPress Plugin ActiveCampaign-Forms, Site Tracking, Live Chat Unspecified Vulnerability (5.7)

Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-18086)

Django Use of Cache Containing Sensitive Information Vulnerability (CVE-2026-35193)

Severity

Critical

Classification

CVE-2015-8390 CWE-908 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities