CVE-2016-3191: Buffer Overflow
The compilebranch function in pcrecompile.c in PCRE 8.x before 8.39 and pcre2compile.c in PCRE2 before 10.22 mishandles patterns containing an (ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.
Other sources
ZDI reported a stack-based buffer overflow in pcre and pcre2. ZDI-CAN-3542 id is used to identify the issue.
https://bugs.exim.org/showbug.cgi?id=1791
PCRE does not validate that handling the (ACCEPT) verb will occur within the bounds of the cworkspace stack buffer, leading to a stack buffer overflow.
Fixed upstream in pcre and pcre2 via the following commits:
http://vcs.pcre.org/pcre?view=revision&revision=1631 http://vcs.pcre.org/pcre2?view=revision&revision=489
Issue is triggered by the following pattern:
/(00/
PCRE 8.00 seems to be the first affected version.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3191?
CVE-2016-3191 has a critical severity level, allowing for remote code execution or denial of service attacks.
How do I fix CVE-2016-3191?
To fix CVE-2016-3191, update to PCRE version 8.39 or PCRE2 version 10.22 or later.
What software is affected by CVE-2016-3191?
CVE-2016-3191 affects PCRE versions prior to 8.39 and PCRE2 versions prior to 10.22.
Can CVE-2016-3191 be exploited remotely?
Yes, CVE-2016-3191 can be exploited remotely through specially crafted patterns.
What vulnerabilities does CVE-2016-3191 relate to?
CVE-2016-3191 relates to vulnerabilities in pattern handling, specifically involving the (*ACCEPT) substring.