CVE-2015-8382: Buffer Overflow
It was reported that pcreexec in PHP pcre extension partially initialize a buffer when an invalid regex is processed, which can information disclosure.
A mitigation fix have been applied in PHP 5.4+ http://git.php.net/?p=php-src.git;a=commitdiff;h=c351b47ce85a3a147cfa801fa9f0149ab4160834
Upstream bug report (with a patch proposal): http://bugs.exim.org/showbug.cgi?id=1537
Other sources
The match function in pcreexec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((ACCEPT)))/ pattern and related patterns involving (ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8382?
CVE-2015-8382 has been classified with a severity that allows for information disclosure potential.
How do I fix CVE-2015-8382?
To mitigate CVE-2015-8382, ensure you are using PHP version 5.4 or higher where patch fixes have been applied.
What software is affected by CVE-2015-8382?
CVE-2015-8382 affects the PCRE library versions up to and including 8.36.
Can CVE-2015-8382 lead to any exploits?
Yes, CVE-2015-8382 can lead to scenarios where an attacker may exploit buffer initialization issues to disclose sensitive information.
Is there a specific version of PHP that addresses CVE-2015-8382?
Yes, PHP versions 5.4 and above include mitigations for the vulnerability outlined in CVE-2015-8382.