Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - pcre: Integer overflow caused by missing check for certain conditions (8.38/31) (CVE-2015-8394)

  - PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal     recursive back references, which allows remote attackers to cause a denial of service (segmentation fault)     or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror. (CVE-2015-2327)

  - PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote     attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as     demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/. (CVE-2015-3217)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - pcre: inefficient posix character class syntax check (8.38/16) (CVE-2015-8391)

  - pcre: Integer overflow caused by missing check for certain conditions (8.38/31) (CVE-2015-8394)

  - PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal     recursive back references, which allows remote attackers to cause a denial of service (segmentation fault)     or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror. (CVE-2015-2327)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1132 advisory.

  - pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4)     (CVE-2015-3210, CVE-2015-8384)

  - pcre: stack overflow caused by mishandled group empty match (8.38/11) (CVE-2015-3217)

  - mysql: unspecified vulnerability related to Server:Partition (CPU October 2015) (CVE-2015-4792,     CVE-2015-4802)

  - mysql: unspecified vulnerability related to Server:DDL (CPU October 2015) (CVE-2015-4815)

  - mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015) (CVE-2015-4816,     CVE-2015-4861, CVE-2015-4895)

  - mysql: unspecified vulnerability related to Client programs (CPU October 2015) (CVE-2015-4819)

  - mysql: unspecified vulnerability related to Server:Types (CPU October 2015) (CVE-2015-4826)

  - mysql: unspecified vulnerability related to Server:Security:Privileges (CPU October 2015) (CVE-2015-4830)

  - mysql: unspecified vulnerability related to Server:SP (CPU October 2015) (CVE-2015-4836)

  - mysql: unspecified vulnerability related to Server:DML (CPU October 2015) (CVE-2015-4858, CVE-2015-4879,     CVE-2015-4913)

  - mysql: unspecified vulnerability related to Server:Parser (CPU October 2015) (CVE-2015-4870)

  - pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis     (8.38/18) (CVE-2015-5073, CVE-2015-8388)

  - pcre: Buffer overflow caused by duplicate named references (8.38/36) (CVE-2015-8381, CVE-2015-8395)

  - pcre: Buffer overflow caused by repeated conditional group (8.38/3) (CVE-2015-8383)

  - pcre: buffer overflow caused by named forward reference to duplicate group number (8.38/30)     (CVE-2015-8385)

  - pcre: Buffer overflow caused by lookbehind assertion (8.38/6) (CVE-2015-8386)

  - pcre: inefficient posix character class syntax check (8.38/16) (CVE-2015-8391)

  - pcre: buffer overflow caused by patterns with duplicated named groups with (?| (8.38/27) (CVE-2015-8392)

  - mysql: unspecified vulnerability in subcomponent: Server: Options (CPU January 2016) (CVE-2016-0505)

  - mysql: unspecified vulnerability in subcomponent: Client (CPU January 2016) (CVE-2016-0546)

  - mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016) (CVE-2016-0596,     CVE-2016-0598)

  - mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016) (CVE-2016-0597,     CVE-2016-0616)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU January 2016) (CVE-2016-0600,     CVE-2016-0610)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU January 2016)     (CVE-2016-0606)

  - mysql: unspecified vulnerability in subcomponent: Server: UDF (CPU January 2016) (CVE-2016-0608)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU January 2016)     (CVE-2016-0609)

  - mysql: unspecified vulnerability in subcomponent: Server: DML (CPU April 2016) (CVE-2016-0640,     CVE-2016-0643, CVE-2016-0646)

  - mysql: unspecified vulnerability in subcomponent: Server: MyISAM (CPU April 2016) (CVE-2016-0641)

  - mysql: unspecified vulnerability in subcomponent: Server: Federated (CPU April 2016) (CVE-2016-0642)

  - mysql: unspecified vulnerability in subcomponent: Server: DDL (CPU April 2016) (CVE-2016-0644)

  - mysql: unspecified vulnerability in subcomponent: Server: FTS (CPU April 2016) (CVE-2016-0647)

  - mysql: unspecified vulnerability in subcomponent: Server: PS (CPU April 2016) (CVE-2016-0648,     CVE-2016-0649)

  - mysql: unspecified vulnerability in subcomponent: Server: Replication (CPU April 2016) (CVE-2016-0650)

  - mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016) (CVE-2016-0651)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU April 2016) (CVE-2016-0655,     CVE-2016-0668)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU April 2016)     (CVE-2016-0666)

  - pcre: heap buffer overflow in handling of duplicate named groups (8.39/14) (CVE-2016-1283)

  - mysql: ssl-validate-cert incorrect hostname check (CVE-2016-2047)

  - pcre: workspace overflow for (*ACCEPT) with deeply nested parentheses (8.39/13, 10.22/12) (CVE-2016-3191)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU July 2016)     (CVE-2016-3452)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU July 2016) (CVE-2016-3459)

  - mysql: unspecified vulnerability in subcomponent: Server: Option (CPU July 2016) (CVE-2016-3471)

  - mysql: unspecified vulnerability in subcomponent: Server: Connection (CPU July 2016) (CVE-2016-5444)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of glib2 installed on the remote host is prior to 2.36.3-5.26. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1775 advisory.

  - Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows     remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and     possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing     parenthesis. (CVE-2015-5073)

  - PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers     to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a     crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
    (CVE-2015-8390)

  - PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers     to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted     regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
    (CVE-2015-8394)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of pcre installed on the remote host is prior to 8.21-7.9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1767 advisory.

  - Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows     remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and     possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing     parenthesis. (CVE-2015-5073)

  - PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers     to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a     crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
    (CVE-2015-8390)

  - PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers     to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted     regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
    (CVE-2015-8394)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glib2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in GNOME GLib before 2.66.6 and     2.67.x before 2.67.3. The function g_bytes_new has an     integer overflow on 64-bit platforms due to an implicit     cast from 64 bits to 32 bits. The overflow could     potentially lead to memory corruption.(CVE-2021-27219)

  - An issue was discovered in GNOME GLib before 2.66.7 and     2.67.x before 2.67.4. If g_byte_array_new_take() was     called with a buffer of 4GB or more on a 64-bit     platform, the length would be truncated modulo 2**32,     causing unintended length truncation.(CVE-2021-27218)

  - An issue was discovered in GNOME GLib before 2.66.8.
    When g_file_replace() is used with     G_FILE_CREATE_REPLACE_DESTINATION to replace a path     that is a dangling symlink, it incorrectly also creates     the target of the symlink as an empty file, which could     conceivably have security relevance if the symlink is     attacker-controlled. (If the path is a symlink to a     file that already exists, then the contents of that     file correctly remain unchanged.)(CVE-2021-28153)

  - Heap-based buffer overflow in the find_fixedlength     function in pcre_compile.c in PCRE before 8.38 allows     remote attackers to cause a denial of service (crash)     or obtain sensitive information from heap memory and     possibly bypass the ASLR protection mechanism via a     crafted regular expression with an excess closing     parenthesis.(CVE-2015-5073)

  - PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10     mishandle group empty matches, which might allow remote     attackers to cause a denial of service (stack-based     buffer overflow) via a crafted regular expression, as     demonstrated by     /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.(CVE-2015-3217)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glib2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10     mishandle group empty matches, which might allow remote     attackers to cause a denial of service (stack-based     buffer overflow) via a crafted regular expression, as     demonstrated by     /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.(CVE-2015-3217)

  - Heap-based buffer overflow in the find_fixedlength     function in pcre_compile.c in PCRE before 8.38 allows     remote attackers to cause a denial of service (crash)     or obtain sensitive information from heap memory and     possibly bypass the ASLR protection mechanism via a     crafted regular expression with an excess closing     parenthesis.(CVE-2015-5073)

  - The keyfile settings backend in GNOME GLib (aka     glib2.0) before 2.60.0 creates directories using     g_file_make_directory_with_parents (kfsb->dir, NULL,     NULL) and files using g_file_replace_contents     (kfsb->file, contents, length, NULL, FALSE,     G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL).
    Consequently, it does not properly restrict directory     (and file) permissions. Instead, for directories, 0777     permissions are used for files, default file     permissions are used. This is similar to     CVE-2019-12450.(CVE-2019-13012)

  - file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0     through 2.61.1 does not properly restrict file     permissions while a copy operation is in progress.
    Instead, default permissions are used.(CVE-2019-12450)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the pcre packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/     pattern and related patterns with certain recursion,     which allows remote attackers to cause a denial of     service (segmentation fault) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror.(CVE-2015-2328)

  - PCRE before 8.38 mishandles the : and \\\\ substrings     in character classes, which allows remote attackers to     cause a denial of service (uninitialized memory read)     or possibly have unspecified other impact via a crafted     regular expression, as demonstrated by a JavaScript     RegExp object encountered by Konqueror.(CVE-2015-8390)

  - Heap-based buffer overflow in the find_fixedlength     function in pcre_compile.c in PCRE before 8.38 allows     remote attackers to cause a denial of service (crash)     or obtain sensitive information from heap memory and     possibly bypass the ASLR protection mechanism via a     crafted regular expression with an excess closing     parenthesis.(CVE-2015-5073)

  - PCRE before 8.38 mishandles (?123) subroutine calls and     related subroutine calls, which allows remote attackers     to cause a denial of service (integer overflow) or     possibly have unspecified other impact via a crafted     regular expression, as demonstrated by a JavaScript     RegExp object encountered by Konqueror.(CVE-2015-8387)

  - The pcre_exec function in pcre_exec.c in PCRE before     8.38 mishandles a // pattern with a \\01 string, which     allows remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror.(CVE-2015-8380)

  - The compile_branch function in pcre_compile.c in PCRE     8.x before 8.39 and pcre2_compile.c in PCRE2 before     10.22 mishandles patterns containing an (*ACCEPT)     substring in conjunction with nested parentheses, which     allows remote attackers to execute arbitrary code or     cause a denial of service (stack-based buffer overflow)     via a crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror, aka     ZDI-CAN-3542.(CVE-2016-3191)

  - The pcre_compile function in pcre_compile.c in PCRE     before 8.38 mishandles certain : nesting, which allows     remote attackers to cause a denial of service (CPU     consumption) or possibly have unspecified other impact     via a crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by     Konqueror.(CVE-2015-8391)

  - PCRE before 8.36 mishandles the     /(((a\\2)|(a*)\\gi1/4oe-1i1/4z))*/ pattern and related     patterns with certain internal recursive back     references, which allows remote attackers to cause a     denial of service (segmentation fault) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror.(CVE-2015-2327)

  - PCRE before 8.38 mishandles the (?(i1/4oedigitsi1/4z) and     (?(Ri1/4oedigitsi1/4z) conditions, which allows remote     attackers to cause a denial of service (integer     overflow) or possibly have unspecified other impact via     a crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by     Konqueror.(CVE-2015-8394)

  - PCRE before 8.38 mishandles the     /(?=di(?i1/4oe=(?1))|(?=(.))))/ pattern and related     patterns with an unmatched closing parenthesis, which     allows remote attackers to cause a denial of service     (buffer overflow) or possibly have unspecified other     impact via a crafted regular expression, as     demonstrated by a JavaScript RegExp object encountered     by Konqueror.(CVE-2015-8388)

  - PCRE before 8.38 mishandles the interaction of     lookbehind assertions and mutually recursive     subpatterns, which allows remote attackers to cause a     denial of service (buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror.(CVE-2015-8386)

  - PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10     mishandle group empty matches, which might allow remote     attackers to cause a denial of service (stack-based     buffer overflow) via a crafted regular expression, as     demonstrated by     /^(?:(?(1)\\\\.|(^\\\\\\\\W_)?)+)+$/.(CVE-2015-3217)

  - PCRE before 8.38 mishandles the /(?|(\\k'Pm')|(?'Pm'))/     pattern and related patterns with certain forward     references, which allows remote attackers to cause a     denial of service (buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror.(CVE-2015-8385)

  - A flaw was found in the way PCRE handled certain     malformed regular expressions. This issue could cause     an application (for example, Konqueror) linked against     PCRE to crash while parsing malicious regular     expressions.(CVE-2014-8964)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the pcre packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the way PCRE handled     malformed regular expressions. An attacker able to make     an application using PCRE process a specially crafted     regular expression could use these flaws to cause the     application to crash or, possibly, execute arbitrary     code. (CVE-2015-8385, CVE-2016-3191, CVE-2015-2328,     CVE-2015-3217, CVE-2015-5073, CVE-2015-8388,     CVE-2015-8391, CVE-2015-8386)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis. (CVE-2015-5073)

This update for pcre to version 8.39 (bsc#972127) fixes several issues. If you use pcre extensively please be aware that this is an update to a new version. Please make sure that your software works with the updated version. This version fixes a number of vulnerabilities that affect pcre and applications using the libary when accepting untrusted input as regular expressions or as part thereof. Remote attackers could have caused the application to crash, disclose information or potentially execute arbitrary code. These security issues were fixed :

  - CVE-2014-8964: Heap-based buffer overflow in PCRE     allowed remote attackers to cause a denial of service     (crash) or have other unspecified impact via a crafted     regular expression, related to an assertion that allows     zero repeats (bsc#906574).

  - CVE-2015-2325: Heap buffer overflow in compile_branch()     (bsc#924960).

  - CVE-2015-3210: Heap buffer overflow in pcre_compile2() /     compile_regex() (bsc#933288)

  - CVE-2015-3217: PCRE Library Call Stack Overflow     Vulnerability in match() (bsc#933878).

  - CVE-2015-5073: Library Heap Overflow Vulnerability in     find_fixedlength() (bsc#936227).

  - bsc#942865: heap overflow in compile_regex()

  - CVE-2015-8380: The pcre_exec function in pcre_exec.c     mishandled a // pattern with a \01 string, which allowed     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror (bsc#957566).

  - CVE-2015-2327: PCRE mishandled certain patterns with     internal recursive back references, which allowed remote     attackers to cause a denial of service (segmentation     fault) or possibly have unspecified other impact via a     crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror     (bsc#957567).

  - bsc#957598: Various security issues

  - CVE-2015-8381: Heap Overflow in compile_regex()     (bsc#957598).

  - CVE-2015-8382: Regular Expression Uninitialized Pointer     Information Disclosure Vulnerability     (ZDI-CAN-2547)(bsc#957598).

  - CVE-2015-8383: Buffer overflow caused by repeated     conditional group(bsc#957598).

  - CVE-2015-8384: Buffer overflow caused by recursive back     reference by name within certain group(bsc#957598).

  - CVE-2015-8385: Buffer overflow caused by forward     reference by name to certain group(bsc#957598).

  - CVE-2015-8386: Buffer overflow caused by lookbehind     assertion(bsc#957598).

  - CVE-2015-8387: Integer overflow in subroutine     calls(bsc#957598).

  - CVE-2015-8388: Buffer overflow caused by certain     patterns with an unmatched closing     parenthesis(bsc#957598).

  - CVE-2015-8389: Infinite recursion in JIT compiler when     processing certain patterns(bsc#957598).

  - CVE-2015-8390: Reading from uninitialized memory when     processing certain patterns(bsc#957598).

  - CVE-2015-8391: Some pathological patterns causes     pcre_compile() to run for a very long time(bsc#957598).

  - CVE-2015-8392: Buffer overflow caused by certain     patterns with duplicated named groups(bsc#957598).

  - CVE-2015-8393: Information leak when running pcgrep -q     on crafted binary(bsc#957598).

  - CVE-2015-8394: Integer overflow caused by missing check     for certain conditions(bsc#957598).

  - CVE-2015-8395: Buffer overflow caused by certain     references(bsc#957598).

  - CVE-2015-2328: PCRE mishandled the /((?(R)a|(?1)))+/     pattern and related patterns with certain recursion,     which allowed remote attackers to cause a denial of     service (segmentation fault) or possibly have     unspecified other impact via a crafted regular     expression (bsc#957600).

  - CVE-2016-1283: The pcre_compile2 function in     pcre_compile.c in PCRE mishandled certain patterns with     named subgroups, which allowed remote attackers to cause     a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted     regular expression (bsc#960837).

  - CVE-2016-3191: The compile_branch function in     pcre_compile.c in pcre2_compile.c mishandled patterns     containing an (*ACCEPT) substring in conjunction with     nested parentheses, which allowed remote attackers to     execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted regular     expression (bsc#971741).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for pcre to version 8.39 (bsc#972127) fixes several issues.

If you use pcre extensively please be aware that this is an update to a new version. Please make sure that your software works with the updated version.

This version fixes a number of vulnerabilities that affect pcre and applications using the libary when accepting untrusted input as regular expressions or as part thereof. Remote attackers could have caused the application to crash, disclose information or potentially execute arbitrary code. These security issues were fixed :

  - CVE-2014-8964: Heap-based buffer overflow in PCRE     allowed remote attackers to cause a denial of service     (crash) or have other unspecified impact via a crafted     regular expression, related to an assertion that allows     zero repeats (bsc#906574).

  - CVE-2015-2325: Heap buffer overflow in compile_branch()     (bsc#924960).

  - CVE-2015-3210: Heap buffer overflow in pcre_compile2() /     compile_regex() (bsc#933288)

  - CVE-2015-3217: PCRE Library Call Stack Overflow     Vulnerability in match() (bsc#933878).

  - CVE-2015-5073: Library Heap Overflow Vulnerability in     find_fixedlength() (bsc#936227).

  - bsc#942865: heap overflow in compile_regex()

  - CVE-2015-8380: The pcre_exec function in pcre_exec.c     mishandled a // pattern with a \01 string, which allowed     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror (bsc#957566).

  - CVE-2015-2327: PCRE mishandled certain patterns with     internal recursive back references, which allowed remote     attackers to cause a denial of service (segmentation     fault) or possibly have unspecified other impact via a     crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror     (bsc#957567).

  - bsc#957598: Various security issues 

  - CVE-2015-8381: Heap Overflow in compile_regex()     (bsc#957598).

  - CVE-2015-8382: Regular Expression Uninitialized Pointer     Information Disclosure Vulnerability     (ZDI-CAN-2547)(bsc#957598).

  - CVE-2015-8383: Buffer overflow caused by repeated     conditional group(bsc#957598).

  - CVE-2015-8384: Buffer overflow caused by recursive back     reference by name within certain group(bsc#957598).

  - CVE-2015-8385: Buffer overflow caused by forward     reference by name to certain group(bsc#957598).

  - CVE-2015-8386: Buffer overflow caused by lookbehind     assertion(bsc#957598).

  - CVE-2015-8387: Integer overflow in subroutine     calls(bsc#957598).

  - CVE-2015-8388: Buffer overflow caused by certain     patterns with an unmatched closing     parenthesis(bsc#957598).

  - CVE-2015-8389: Infinite recursion in JIT compiler when     processing certain patterns(bsc#957598).

  - CVE-2015-8390: Reading from uninitialized memory when     processing certain patterns(bsc#957598).

  - CVE-2015-8391: Some pathological patterns causes     pcre_compile() to run for a very long time(bsc#957598).

  - CVE-2015-8392: Buffer overflow caused by certain     patterns with duplicated named groups(bsc#957598).

  - CVE-2015-8393: Information leak when running pcgrep -q     on crafted binary(bsc#957598).

  - CVE-2015-8394: Integer overflow caused by missing check     for certain conditions(bsc#957598).

  - CVE-2015-8395: Buffer overflow caused by certain     references(bsc#957598).

  - CVE-2015-2328: PCRE mishandled the /((?(R)a|(?1)))+/     pattern and related patterns with certain recursion,     which allowed remote attackers to cause a denial of     service (segmentation fault) or possibly have     unspecified other impact via a crafted regular     expression (bsc#957600).

  - CVE-2016-1283: The pcre_compile2 function in     pcre_compile.c in PCRE mishandled certain patterns with     named subgroups, which allowed remote attackers to cause     a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted     regular expression (bsc#960837).

  - CVE-2016-3191: The compile_branch function in     pcre_compile.c in pcre2_compile.c mishandled patterns     containing an (*ACCEPT) substring in conjunction with     nested parentheses, which allowed remote attackers to     execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted regular     expression (bsc#971741).

These non-security issues were fixed :

  - JIT compiler improvements

  - performance improvements

  - The Unicode data tables have been updated to Unicode     7.0.0.

This update was imported from the SUSE:SLE-12:Update update project.

This version fixes a number of vulnerabilities that affect pcre and applications using the libary when accepting untrusted input as regular expressions or as part thereof. Remote attackers could have caused the application to crash, disclose information or potentially execute arbitrary code.

  - Update to PCRE 8.39 FATE#320298 boo#972127.

  - CVE-2015-3210: heap buffer overflow in pcre_compile2() /     compile_regex() (boo#933288)

  - CVE-2015-3217: pcre: PCRE Library Call Stack Overflow     Vulnerability in match() (boo#933878)

  - CVE-2015-5073: pcre: Library Heap Overflow Vulnerability     in find_fixedlength() (boo#936227)

  - boo#942865: heap overflow in compile_regex()

  - CVE-2015-8380: pcre: heap overflow in pcre_exec     (boo#957566)

  - boo#957598: various security issues fixed in pcre 8.37     and 8.38 release

  - CVE-2016-1283: pcre: Heap buffer overflow in     pcre_compile2 causes DoS (boo#960837)

  - CVE-2016-3191: pcre: workspace overflow for (*ACCEPT)     with deeply nested parentheses (boo#971741)

The remote host is affected by the vulnerability described in GLSA-201607-02 (libpcre: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in libpcre. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

An update for pcre is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

PCRE is a Perl-compatible regular expression library.

Security Fix(es) :

* Multiple flaws were found in the way PCRE handled malformed regular expressions. An attacker able to make an application using PCRE process a specially crafted regular expression could use these flaws to cause the application to crash or, possibly, execute arbitrary code. (CVE-2015-8385, CVE-2016-3191, CVE-2015-2328, CVE-2015-3217, CVE-2015-5073, CVE-2015-8388, CVE-2015-8391, CVE-2015-8386)

Security Fix(es) :

  - Multiple flaws were found in the way PCRE handled     malformed regular expressions. An attacker able to make     an application using PCRE process a specially crafted     regular expression could use these flaws to cause the     application to crash or, possibly, execute arbitrary     code. (CVE-2015-8385, CVE-2016-3191, CVE-2015-2328,     CVE-2015-3217, CVE-2015-5073, CVE-2015-8388,     CVE-2015-8391, CVE-2015-8386)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1025 advisory.

    - Fix CVE-2015-2328 (infinite recursion compiling pattern with recursive       reference in a group with indefinite repeat) (bug #1330508)
    - Fix CVE-2015-8385 (buffer overflow caused by named forward reference to       duplicate group number) (bug #1330508)
    - Fix CVE-2015-8386 (buffer overflow caused by lookbehind assertion)       (bug #1330508)
    - Fix CVE-2015-3217 (stack overflow caused by mishandled group empty match)       (bug #1330508)
    - Fix CVE-2015-5073 and CVE-2015-8388 (buffer overflow for forward reference       within backward assertion with excess closing parenthesis) (bug #1330508)
    - Fix CVE-2015-8391 (inefficient posix character class syntax check)       (bug #1330508)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2943-1 advisory.

    It was discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use     this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 8.38 and fix various CVE's

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2694-1 advisory.

    Michele Spagnuolo discovered that PCRE incorrectly handled certain regular expressions. A remote attacker     could use this issue to cause applications using PCRE to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-8964)

    Kai Lu discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use     this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-2325,     CVE-2015-2326)

    Wen Guanxing discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could     use this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 15.04. (CVE-2015-3210)

    It was discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use     this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and 14.04 LTS. (CVE-2015-5073)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Venustech ADLAB reports :

PCRE library is prone to a vulnerability which leads to Heap Overflow.
During subpattern calculation of a malformed regular expression, an offset that is used as an array index is fully controlled and can be large enough so that unexpected heap memory regions are accessed.

One could at least exploit this issue to read objects nearby of the affected application's memory.

Such information disclosure may also be used to bypass memory protection method such as ASLR.

This release fixes two heap buffer overflows when compiling certain regular expressions: CVE-2015-3210 and CVE-2015-5073.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
200041	RHEL 6 : pcre (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199957	RHEL 7 : pcre (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
193833	RHEL 6 / 7 : rh-mariadb100-mariadb (RHSA-2016:1132)	Nessus	Red Hat Local Security Checks	critical
177907	Amazon Linux AMI : glib2 (ALAS-2023-1775)	Nessus	Amazon Linux Local Security Checks	critical
177072	Amazon Linux AMI : pcre (ALAS-2023-1767)	Nessus	Amazon Linux Local Security Checks	critical
149187	EulerOS 2.0 SP3 : glib2 (EulerOS-SA-2021-1789)	Nessus	Huawei Local Security Checks	critical
137496	EulerOS 2.0 SP2 : glib2 (EulerOS-SA-2020-1654)	Nessus	Huawei Local Security Checks	critical
125102	EulerOS Virtualization 3.0.1.0 : pcre (EulerOS-SA-2019-1558)	Nessus	Huawei Local Security Checks	critical
99786	EulerOS 2.0 SP1 : pcre (EulerOS-SA-2016-1023)	Nessus	Huawei Local Security Checks	critical
97531	F5 Networks BIG-IP : PCRE library vulnerability (K17331)	Nessus	F5 Networks Local Security Checks	critical
95915	SUSE SLED12 / SLES12 Security Update : pcre (SUSE-SU-2016:3161-1)	Nessus	SuSE Local Security Checks	critical
95754	openSUSE Security Update : pcre (openSUSE-2016-1448)	Nessus	SuSE Local Security Checks	critical
95534	SUSE SLED12 / SLES12 Security Update : pcre (SUSE-SU-2016:2971-1)	Nessus	SuSE Local Security Checks	critical
94906	openSUSE Security Update : pcre (openSUSE-2016-1303)	Nessus	SuSE Local Security Checks	critical
91983	GLSA-201607-02 : libpcre: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
91104	CentOS 7 : pcre (CESA-2016:1025)	Nessus	CentOS Local Security Checks	critical
91081	Scientific Linux Security Update : pcre on SL7.x x86_64 (20160511)	Nessus	Scientific Linux Local Security Checks	critical
91078	RHEL 7 : pcre (RHSA-2016:1025)	Nessus	Red Hat Local Security Checks	critical
91072	Oracle Linux 7 : pcre (ELSA-2016-1025)	Nessus	Oracle Linux Local Security Checks	critical
90306	Ubuntu 14.04 LTS : PCRE vulnerabilities (USN-2943-1)	Nessus	Ubuntu Local Security Checks	critical
89647	Fedora 23 : mingw-pcre-8.38-1.fc23 (2016-fd1199dbe2)	Nessus	Fedora Local Security Checks	critical
89641	Fedora 22 : mingw-pcre-8.38-1.fc22 (2016-f59a8ff5d0)	Nessus	Fedora Local Security Checks	critical
85122	Ubuntu 14.04 LTS : PCRE vulnerabilities (USN-2694-1)	Nessus	Ubuntu Local Security Checks	critical
84887	FreeBSD : pcre -- Heap Overflow Vulnerability in find_fixedlength() (8a1d0e63-1e07-11e5-b43d-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical
84843	Fedora 21 : pcre-8.35-12.fc21 (2015-11019)	Nessus	Fedora Local Security Checks	critical
84685	Fedora 22 : pcre-8.37-2.fc22 (2015-11027)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2015-5073

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical