CVE-2015-8394: Integer Overflow
PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Other sources
Upgraded bundled PCRE library to 8.38. (CVE-2015-8383, CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
— PHP
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8394?
CVE-2015-8394 has a severity level that may allow remote attackers to cause denial of service through integer overflow.
How do I fix CVE-2015-8394?
To fix CVE-2015-8394, update to PCRE version 8.38 or later and ensure PHP is patched to versions above 5.5.32, 5.6.18, or 7.0.3.
What types of software are affected by CVE-2015-8394?
CVE-2015-8394 affects multiple versions of PCRE and PHP prior to specific patched versions.
Can CVE-2015-8394 be exploited remotely?
Yes, CVE-2015-8394 can be exploited by remote attackers using crafted regular expressions.
What impact can CVE-2015-8394 have on systems?
The impact of CVE-2015-8394 can include denial of service and potentially other unspecified effects.