CVE-2015-8392: Buffer Overflow
A buffer overflow vulnerability in PCRE before 8.38 was found, caused by pattern with duplicated named groups and an occurrence of (?| , it is possible for an apparently non-recursive back reference to become recursive if a later named group with the relevant number is encountered. This allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
Other sources
PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8392?
CVE-2015-8392 is classified as a denial of service vulnerability due to unintended recursion and buffer overflow.
How do I fix CVE-2015-8392?
To mitigate CVE-2015-8392, update the PCRE library to version 8.38 or later.
What software is affected by CVE-2015-8392?
CVE-2015-8392 affects PCRE versions prior to 8.38, including versions up to 8.37.
What impact can CVE-2015-8392 have on systems?
CVE-2015-8392 can allow remote attackers to cause denial of service, potentially affecting service availability.
When was the vulnerability CVE-2015-8392 discovered?
CVE-2015-8392 was reported in 2015, highlighting issues in the parsing of certain regular expressions.