CVE-2016-1283: Buffer Overflow
Fixed bug (applied upstream patch for CVE-2016-1283).
Other sources
It was found that pcrecompile2 function in pcrecompile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service via heap-based buffer overflow.
Upstream bug:
https://bugs.exim.org/showbug.cgi?id=1767
— Red Hat
The pcrecompile2 function in pcrecompile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1283?
CVE-2016-1283 has been classified as a high severity vulnerability, impacting the stability of applications that rely on the affected versions of PCRE.
How do I fix CVE-2016-1283?
To fix CVE-2016-1283, upgrade PCRE to version 8.39 or later, or PHP to versions above 7.0.25.
What systems are affected by CVE-2016-1283?
CVE-2016-1283 affects PCRE version 8.38 and PHP versions up to 7.0.25, along with specific versions of Fedora and Oracle Solaris.
What type of attack is possible with CVE-2016-1283?
CVE-2016-1283 allows remote attackers to cause a denial of service through specially crafted regular expression patterns.
Is there a workaround for CVE-2016-1283 until I can update?
The best mitigation for CVE-2016-1283 is to avoid using vulnerable regular expressions if the software cannot be upgraded immediately.