CVE-2015-3210: Buffer Overflow
Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/, a different vulnerability than CVE-2015-8384.
Other sources
It was discovered that PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references within group that had the same name as another group.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3210?
CVE-2015-3210 is considered a critical vulnerability that can lead to remote code execution.
How do I fix CVE-2015-3210?
You can fix CVE-2015-3210 by upgrading to PCRE version 8.38 or later.
Which versions are vulnerable to CVE-2015-3210?
PCRE versions 8.34 through 8.37 and PCRE2 version 10.10 are vulnerable to CVE-2015-3210.
Can CVE-2015-3210 affect web applications?
Yes, CVE-2015-3210 can affect web applications that utilize vulnerable versions of the PCRE library for regular expression processing.
What is the impact of exploiting CVE-2015-3210?
Exploitation of CVE-2015-3210 can allow attackers to execute arbitrary code on the affected systems.