NVD

Id
28550  
Name
CVE-2015-8382  
Description
The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:P)  
Pub Date
2017-01-19  
Published
2015-12-01  
Modified Date
2016-12-27  
Seq
2015-8382  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
150006 28550 CVE-2015-8382 http://git.php.net/?p=php-src.git;a=commit;h=c351b47ce85a3a147cfa801fa9f0149ab4160834  View
150007 28550 CVE-2015-8382 http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup  View
150008 28550 CVE-2015-8382 http://vcs.pcre.org/pcre/code/trunk/pcre_exec.c?r1=1502&r2=1510  View
150009 28550 CVE-2015-8382 [oss-security] 20150804 Re: CVE Request: Information disclosure in pcre  View
150010 28550 CVE-2015-8382 [oss-security] 20151128 Re: Heap Overflow in PCRE  View
150011 28550 CVE-2015-8382 76157  View
150012 28550 CVE-2015-8382 https://bto.bluecoat.com/security-advisory/sa128  View
150013 28550 CVE-2015-8382 https://bugs.exim.org/show_bug.cgi?id=1537  View
150014 28550 CVE-2015-8382 https://bugzilla.redhat.com/show_bug.cgi?id=1187225  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
10742 JVNDB-2015-006062 PCRE の pcre_exec.c の match 関数におけるプロセスメモリから重要な情報を取得される脆弱性 PCRE の pcre_exec.c の match 関数は、/(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ パターンおよび (*ACCEPT) を含む関連したパターンを誤って処理するため、プロセスメモリから重要な情報を取得される、またはサービス運用妨害 (メモリの部分的な初期化およびアプリケーションのクラッシュ) 状態にされる脆弱性が存在します。 CVE-2015-8382 85607 CVE-2015-8382 28550 6.4 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-006062.html 2015-04-28 2015-12-03 View