NVD

Id
19026  
Name
CVE-2016-3191  
Description
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-03-17  
Modified Date
2016-12-27  
Seq
2016-3191  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
105541 19026 CVE-2016-3191 http://vcs.pcre.org/pcre?view=revision&revision=1631  View
105542 19026 CVE-2016-3191 http://vcs.pcre.org/pcre2?view=revision&revision=489  View
105543 19026 CVE-2016-3191 http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886  View
105544 19026 CVE-2016-3191 http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html  View
105545 19026 CVE-2016-3191 84810  View
105546 19026 CVE-2016-3191 https://bto.bluecoat.com/security-advisory/sa128  View
105547 19026 CVE-2016-3191 https://bugs.debian.org/815920  View
105548 19026 CVE-2016-3191 https://bugs.debian.org/815921  View
105549 19026 CVE-2016-3191 https://bugs.exim.org/show_bug.cgi?id=1791  View
105550 19026 CVE-2016-3191 https://bugzilla.redhat.com/show_bug.cgi?id=1311503  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1043 JVNDB-2016-001816 PCRE の pcre_compile.c および PCRE2 の pcre2_compile.c の compile_branch 関数における任意のコードを実行される脆弱性 PCRE の pcre_compile.c および PCRE2 の pcre2_compile.c の compile_branch 関数は、ネストされた括弧と併用して、(*ACCEPT) サブストリングを含むパターンを誤って処理するため、任意のコードを実行される、またはサービス運用妨害 (スタックベースのバッファオーバーフロー) 状態にされる脆弱性が存在します。 CVE-2016-3191 89697 CVE-2016-3191 19026 7.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001816.html 2016-02-10 2016-03-23 View