CVE-2015-2326
First published: Tue Jan 14 2020(Updated: )
The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pcre Pcre | <8.37 | |
| Oracle Java Runtime Environment (JRE) | =13.1 | |
| Oracle Java Runtime Environment (JRE) | =13.2 | |
| Mariadb Mariadb | >=10.0.0<10.0.18 | |
| PHP PHP | >=5.4.0<5.4.41 | |
| PHP PHP | >=5.5.0<5.5.26 | |
| PHP PHP | >=5.6.0<5.6.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2015-2326.
What is the severity of CVE-2015-2326?
The severity of CVE-2015-2326 is medium.
Which software versions are affected by CVE-2015-2326?
PCRE before version 8.37, Opensuse 13.1 and 13.2, MariaDB version 10.0.0 to 10.0.18, PHP version 5.4.0 to 5.4.41, PHP version 5.5.0 to 5.5.26, and PHP version 5.6.0 to 5.6.9 are affected by CVE-2015-2326.
How can an attacker exploit CVE-2015-2326?
An attacker can exploit CVE-2015-2326 by using a regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, causing a denial of service (out-of-bounds read).
Is there a fix available for CVE-2015-2326?
Yes, updating to PCRE version 8.37 or later, Opensuse 13.1 or 13.2, MariaDB version 10.0.18 or later, or PHP version 5.4.41 or later, 5.5.26 or later, or 5.6.9 or later will fix CVE-2015-2326.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/author
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/pcre
- canonical/pcre pcre
- vendor/opensuse
- canonical/opensuse opensuse
- version/opensuse opensuse/13.1
- version/opensuse opensuse/13.2
- vendor/mariadb
- canonical/mariadb mariadb
- version/mariadb mariadb/10.0.0
- vendor/php
- canonical/php php
- version/php php/5.4.0
- version/php php/5.5.0
- version/php php/5.6.0