CVE-2016-1283

The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Configurations

Configuration 1 (hide)

cpe:2.3:a:pcre:pcre:8.38:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*

History

No history.

Information

Published : 2016-01-03 00:59

Updated : 2024-02-28 15:21


NVD link : CVE-2016-1283

Mitre link : CVE-2016-1283

CVE.ORG link : CVE-2016-1283


JSON object : View

Products Affected

pcre

  • pcre

fedoraproject

  • fedora

php

  • php

oracle

  • solaris
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer