DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
PCRE (Perl Compatible Regular Expressions): Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2015-12-02
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PCRE (Perl Compatible Regular Expressions) ausnutzen, um einen Denial of Service Angriff durchzuführen und um Informationen offen zu legen.
01
beschreibt (18)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2015-8395US | high7.5 | — | ||
PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expressio… | ||||
| CVE-2015-8394US | critical9.8 | — | ||
PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecifie… | ||||
| CVE-2015-8393US | high7.5 | — | ||
pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a… | ||||
| CVE-2015-8392US | high7.5 | — | ||
PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibl… | ||||
| CVE-2015-8391US | critical9.8 | — | ||
The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possi… | ||||
| CVE-2015-8390US | critical9.8 | — | ||
PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have u… | ||||
| CVE-2015-8389US | critical9.8 | — | ||
PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspe… | ||||
| CVE-2015-8388US | high7.5 | — | ||
PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of se… | ||||
| CVE-2015-8387US | high7.3 | — | ||
PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have uns… | ||||
| CVE-2015-8386US | critical9.8 | — | ||
PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow… | ||||
| CVE-2015-8385US | high7.5 | — | ||
PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buf… | ||||
| CVE-2015-8384US | high7.5 | — | ||
PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of serv… | ||||
| CVE-2015-8383US | critical9.8 | — | ||
PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other imp… | ||||
| CVE-2015-8382US | medium6.4 | — | ||
The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involvi… | ||||
| CVE-2015-8381US | high7.5 | — | ||
The compile_regex function in pcre_compile.c in PCRE before 8.38 and pcre2_compile.c in PCRE2 before 10.2x mishandles the /(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/ a… | ||||
| CVE-2015-8380US | high7.5 | — | ||
The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer o… | ||||
| CVE-2015-2328US | high7.5 | — | ||
PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation faul… | ||||
| CVE-2015-2327US | high7.5 | — | ||
PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denia… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security RHSA-2016:1025-1 vom 2016-05-11external
- Red Hat Security Advisory RHSA-2016:1132-1external
- Ubuntu Security Notice USN-2943-1 vom 2016-03-30external
- Red Hat Security Advisory RHSA-2016:2750 vom 2016-11-15external
- Amazon Linux Security Advisory ALAS2-2023-2082 vom 2023-06-08external
- Amazon Linux Security Advisory ALAS2-2023-2107 vom 2023-07-01external
- Amazon Linux Security Advisory ALAS-2023-1767 vom 2023-06-09external
- Amazon Linux Security Advisory ALAS-2023-1769 vom 2023-06-16external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan