CVE-2015-8389: Buffer Overflow
PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Other sources
Upgraded bundled PCRE library to 8.38. (CVE-2015-8383, CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
— PHP
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8389?
CVE-2015-8389 is classified as a denial of service vulnerability due to infinite recursion caused by crafted regular expressions.
How do I fix CVE-2015-8389?
To fix CVE-2015-8389, upgrade PCRE to version 8.38 or later to mitigate the vulnerability.
What types of software are affected by CVE-2015-8389?
CVE-2015-8389 affects various versions of PCRE, PHP prior to 7.0.3, and Fedora version 22.
Can CVE-2015-8389 be exploited remotely?
Yes, CVE-2015-8389 can be exploited remotely by attackers through crafted regular expressions.
What is the potential impact of CVE-2015-8389?
The potential impact of CVE-2015-8389 includes denial of service due to infinite recursion and possibly other unspecified effects.