CVE-2015-8383: Buffer Overflow
It was found that PCRE before 8.38 mishandles certain repeated conditional groups whose condition was referenced by name if there was more than one group with the given name, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
Other sources
PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
— MITRE
Upgraded bundled PCRE library to 8.38. (CVE-2015-8383, CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
— PHP
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8383?
CVE-2015-8383 is classified as a denial of service vulnerability, potentially leading to buffer overflow.
How do I fix CVE-2015-8383?
To fix CVE-2015-8383, upgrade to PCRE version 8.38 or later.
Which software versions are affected by CVE-2015-8383?
CVE-2015-8383 affects PCRE versions before 8.38 and various PHP versions between 5.5.0 and 7.0.3.
What impact does CVE-2015-8383 have on applications?
CVE-2015-8383 can allow remote attackers to cause denial of service or potentially other unspecified impacts by using crafted regular expressions.
Is there any workaround for CVE-2015-8383?
There are no known workarounds for CVE-2015-8383; the only mitigation is to update the affected software.