CVE-2015-8385: Buffer Overflow
It was found that PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references to a group whose number is the same as the current group.
Other sources
PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8385?
CVE-2015-8385 is rated as a medium severity vulnerability due to its potential to cause denial of service attacks.
How do I fix CVE-2015-8385?
To fix CVE-2015-8385, upgrade to PCRE version 8.38 or later.
What types of software are affected by CVE-2015-8385?
CVE-2015-8385 affects PCRE versions up to 8.37, including certain distributions of Oracle Linux and Red Hat.
What is the impact of CVE-2015-8385?
CVE-2015-8385 can lead to buffer overflow vulnerabilities, potentially allowing for denial of service or other unspecified impacts.
Are there any known exploits for CVE-2015-8385?
While there may not be widely known public exploits, the vulnerability's nature suggests that crafted regular expressions could be used to trigger it.