CVE-2015-8390: Critical severity php vulnerability
PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Other sources
Upgraded bundled PCRE library to 8.38. (CVE-2015-8383, CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
— PHP
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8390?
CVE-2015-8390 is considered a medium severity vulnerability due to its potential to cause denial of service through uninitialized memory reads.
How do I fix CVE-2015-8390?
To fix CVE-2015-8390, upgrade to PCRE version 8.38 or later, or apply patches provided by your software vendor.
What software is affected by CVE-2015-8390?
CVE-2015-8390 affects PCRE versions before 8.38, as well as certain versions of PHP and Fedora 22.
What type of attack is possible with CVE-2015-8390?
CVE-2015-8390 allows remote attackers to exploit crafted regular expressions, leading to denial of service conditions.
Was CVE-2015-8390 publicly disclosed?
Yes, CVE-2015-8390 was publicly disclosed and has references in security mailing lists related to open source security.