The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1132 advisory.

  - pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4)     (CVE-2015-3210, CVE-2015-8384)

  - pcre: stack overflow caused by mishandled group empty match (8.38/11) (CVE-2015-3217)

  - mysql: unspecified vulnerability related to Server:Partition (CPU October 2015) (CVE-2015-4792,     CVE-2015-4802)

  - mysql: unspecified vulnerability related to Server:DDL (CPU October 2015) (CVE-2015-4815)

  - mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015) (CVE-2015-4816,     CVE-2015-4861, CVE-2015-4895)

  - mysql: unspecified vulnerability related to Client programs (CPU October 2015) (CVE-2015-4819)

  - mysql: unspecified vulnerability related to Server:Types (CPU October 2015) (CVE-2015-4826)

  - mysql: unspecified vulnerability related to Server:Security:Privileges (CPU October 2015) (CVE-2015-4830)

  - mysql: unspecified vulnerability related to Server:SP (CPU October 2015) (CVE-2015-4836)

  - mysql: unspecified vulnerability related to Server:DML (CPU October 2015) (CVE-2015-4858, CVE-2015-4879,     CVE-2015-4913)

  - mysql: unspecified vulnerability related to Server:Parser (CPU October 2015) (CVE-2015-4870)

  - pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis     (8.38/18) (CVE-2015-5073, CVE-2015-8388)

  - pcre: Buffer overflow caused by duplicate named references (8.38/36) (CVE-2015-8381, CVE-2015-8395)

  - pcre: Buffer overflow caused by repeated conditional group (8.38/3) (CVE-2015-8383)

  - pcre: buffer overflow caused by named forward reference to duplicate group number (8.38/30)     (CVE-2015-8385)

  - pcre: Buffer overflow caused by lookbehind assertion (8.38/6) (CVE-2015-8386)

  - pcre: inefficient posix character class syntax check (8.38/16) (CVE-2015-8391)

  - pcre: buffer overflow caused by patterns with duplicated named groups with (?| (8.38/27) (CVE-2015-8392)

  - mysql: unspecified vulnerability in subcomponent: Server: Options (CPU January 2016) (CVE-2016-0505)

  - mysql: unspecified vulnerability in subcomponent: Client (CPU January 2016) (CVE-2016-0546)

  - mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016) (CVE-2016-0596,     CVE-2016-0598)

  - mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016) (CVE-2016-0597,     CVE-2016-0616)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU January 2016) (CVE-2016-0600,     CVE-2016-0610)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU January 2016)     (CVE-2016-0606)

  - mysql: unspecified vulnerability in subcomponent: Server: UDF (CPU January 2016) (CVE-2016-0608)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU January 2016)     (CVE-2016-0609)

  - mysql: unspecified vulnerability in subcomponent: Server: DML (CPU April 2016) (CVE-2016-0640,     CVE-2016-0643, CVE-2016-0646)

  - mysql: unspecified vulnerability in subcomponent: Server: MyISAM (CPU April 2016) (CVE-2016-0641)

  - mysql: unspecified vulnerability in subcomponent: Server: Federated (CPU April 2016) (CVE-2016-0642)

  - mysql: unspecified vulnerability in subcomponent: Server: DDL (CPU April 2016) (CVE-2016-0644)

  - mysql: unspecified vulnerability in subcomponent: Server: FTS (CPU April 2016) (CVE-2016-0647)

  - mysql: unspecified vulnerability in subcomponent: Server: PS (CPU April 2016) (CVE-2016-0648,     CVE-2016-0649)

  - mysql: unspecified vulnerability in subcomponent: Server: Replication (CPU April 2016) (CVE-2016-0650)

  - mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016) (CVE-2016-0651)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU April 2016) (CVE-2016-0655,     CVE-2016-0668)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU April 2016)     (CVE-2016-0666)

  - pcre: heap buffer overflow in handling of duplicate named groups (8.39/14) (CVE-2016-1283)

  - mysql: ssl-validate-cert incorrect hostname check (CVE-2016-2047)

  - pcre: workspace overflow for (*ACCEPT) with deeply nested parentheses (8.39/13, 10.22/12) (CVE-2016-3191)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU July 2016)     (CVE-2016-3452)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU July 2016) (CVE-2016-3459)

  - mysql: unspecified vulnerability in subcomponent: Server: Option (CPU July 2016) (CVE-2016-3471)

  - mysql: unspecified vulnerability in subcomponent: Server: Connection (CPU July 2016) (CVE-2016-5444)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.11. It is, therefore, affected by multiple vulnerabilities.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.25. It is, therefore, affected by multiple vulnerabilities.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.32. It is, therefore, affected by multiple vulnerabilities.

Note that the scanner has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

**PHP version 7.1.11** (26 Oct 2017)

**Core:**

  - Fixed bug php#75241 (NULL pointer dereference in     zend_mm_alloc_small()). (Laruence)

  - Fixed bug php#75236 (infinite loop when printing an     error-message). (Andrea)

  - Fixed bug php#75252 (Incorrect token formatting on two     parse errors in one request). (Nikita)

  - Fixed bug php#75220 (Segfault when calling is_callable     on parent). (andrewnester)

  - Fixed bug php#75290 (debug info of Closures of internal     functions contain garbage argument names). (Andrea)

**Date:**

  - Fixed bug php#75055 (Out-Of-Bounds Read in     timelib_meridian()). (Derick)

**Apache2Handler:**

  - Fixed bug php#75311 (error: 'zend_hash_key' has no     member named 'arKey' in apache2handler). (mcarbonneaux)

**Hash:**

  - Fixed bug php#75303 (sha3 hangs on bigendian). (Remi)

**Intl:**

  - Fixed bug php#75318 (The parameter of     UConverter::getAliases() is not optional). (cmb)

**mcrypt:**

  - Fixed bug php#72535 (arcfour encryption stream filter     crashes php). (Leigh)

**MySQLi:**

  - Fixed bug php#75018 (Data corruption when reading fields     of bit type). (Anatol)

**Opcache**

  - Fixed bug php#75255 (Request hangs and not finish).
    (Dmitry)

**PCRE:**

  - Fixed bug php#75207 (applied upstream patch for     CVE-2016-1283). (Anatol)

**PDO_mysql:**

  - Fixed bug php#75177 (Type 'bit' is fetched as unexpected     string). (Anatol)

**SPL:**

  - Fixed bug php#73629     (SplDoublyLinkedList::setIteratorMode masks intern     flags). (J. Jeising, cmb)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

pcre: heap buffer overflow in handling of duplicate named groups (8.39/14)

The pcre_compile2 function in pcre_compile.c mishandles a specific type of pattern with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
(CVE-2016-1283)

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by a PCRE denial of service vulnerability in the bundled version of PHP.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.11. It is, therefore, affected by multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.25. It is, therefore, affected by multiple vulnerabilities.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.32. It is, therefore, affected by multiple vulnerabilities.

**PHP version 7.0.25** (26 Oct 2017)

**Core:**

  - Fixed bug php#75241 (NULL pointer dereference in     zend_mm_alloc_small()). (Laruence)

  - Fixed bug php#75236 (infinite loop when printing an     error-message). (Andrea)

  - Fixed bug php#75252 (Incorrect token formatting on two     parse errors in one request). (Nikita)

  - Fixed bug php#75220 (Segfault when calling is_callable     on parent). (andrewnester)

  - Fixed bug php#75290 (debug info of Closures of internal     functions contain garbage argument names). (Andrea)

**Apache2Handler:**

  - Fixed bug php#75311 (error: 'zend_hash_key' has no     member named 'arKey' in apache2handler). (mcarbonneaux)

**Date:**

  - Fixed bug php#75055 (Out-Of-Bounds Read in     timelib_meridian()). (Derick)

**Intl:**

  - Fixed bug php#75318 (The parameter of     UConverter::getAliases() is not optional). (cmb)

**mcrypt:**

  - Fixed bug php#72535 (arcfour encryption stream filter     crashes php). (Leigh)

**PCRE:**

  - Fixed bug php#75207 (applied upstream patch for     CVE-2016-1283). (Anatol)

**litespeed:**

  - Fixed bug php#75248 (Binary directory doesn't get     created when building only litespeed SAPI). (petk)

  - Fixed bug php#75251 (Missing program prefix and suffix).
    (petk)

**SPL:**

  - Fixed bug php#73629     (SplDoublyLinkedList::setIteratorMode masks intern     flags). (J. Jeising, cmb)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The PHP project reports :

The PHP development team announces the immediate availability of PHP 5.6.32. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

The PHP development team announces the immediate availability of PHP 7.0.25. This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

The PHP development team announces the immediate availability of PHP 7.1.11. This is a bugfix release, with several bug fixes included. All PHP 7.1 users are encouraged to upgrade to this version.

New php packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

The version of Tenable Log Correlation Engine (LCE) installed on the remote host is prior to 4.8.1. It is, therefore, affected by the following vulnerabilities :

  - Multiple cross-site scripting (XSS) vulnerabilities     exist in the Handlebars library in the     lib/handlebars/utils.js script due to a failure to     properly escape input passed as unquoted attributes to     templates. An unauthenticated, remote attacker can     exploit these vulnerabilities, via a specially crafted     request, to execute arbitrary script code in a user's     browser session. (CVE-2015-8861, CVE-2015-8862)

  - A heap-based buffer overflow condition exists in the     Perl-Compatible Regular Expressions (PCRE) component     that is triggered when processing nested back references     in a duplicate named group. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1283)

  - An out-of-bounds read error exists in the libxml2     component in parserInternals.c due to improper parsing     of characters in an XML file. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-1833)

  - An overflow condition exists in the libxml2 component in     xmlstring.c due to improper validation of user-supplied     input when handling a string with NULL. An     unauthenticated, remote attacker can exploit this, via a     specially crafted file, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1834)

  - Multiple use-after-free errors exist in the libxml2     component in parser.c that is triggered when parsing     complex names. An unauthenticated, remote attacker can     exploit these issues, via a specially crafted file, to     dereference already freed memory and potentially execute     arbitrary code. (CVE-2016-1835, CVE-2016-1836)

  - Multiple heap-based buffer overflow conditions exist in     the libxml2 component in HTMLparser.c and xmlregexp.c     due to improper validation of user-supplied input when     parsing characters in a range. An unauthenticated,     remote attacker can exploit these issues, via a     specially crafted file, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1837, CVE-2016-1839, CVE-2016-1840)

  - Multiple out-of-bounds read errors exist in the libxml2     component in parser.c. An unauthenticated, remote     attacker can exploit these issues to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-1838, CVE-2016-4447)

  - A heap buffer overflow condition exists in the OpenSSL     component in the EVP_EncodeUpdate() function within file     crypto/evp/encode.c that is triggered when handling a     large amount of input data. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition. (CVE-2016-2105)

  - A heap buffer overflow condition exists in the OpenSSL     component in the EVP_EncryptUpdate() function within     file crypto/evp/evp_enc.c that is triggered when     handling a large amount of input data after a previous     call occurs to the same function with a partial block.
    An unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2016-2106)

  - Flaws exist in the aesni_cbc_hmac_sha1_cipher()     function in file crypto/evp/e_aes_cbc_hmac_sha1.c and     the aesni_cbc_hmac_sha256_cipher() function in file     crypto/evp/e_aes_cbc_hmac_sha256.c that are triggered     when the connection uses an AES-CBC cipher and AES-NI     is supported by the server. A man-in-the-middle attacker     can exploit these to conduct a padding oracle attack,     resulting in the ability to decrypt the network traffic.
    (CVE-2016-2107)

  - A remote code execution vulnerability exists in the     OpenSSL component in the ASN.1 encoder due to an     underflow condition that occurs when attempting to     encode the value zero represented as a negative integer.
    An unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in the execution of arbitrary     code. (CVE-2016-2108)

  - Multiple unspecified flaws exist in the d2i BIO     functions when reading ASN.1 data from a BIO due to     invalid encoding causing a large allocation of memory.
    An unauthenticated, remote attacker can exploit these to     cause a denial of service condition through resource     exhaustion. (CVE-2016-2109)

  - An out-of-bounds read error exists in the     X509_NAME_oneline() function within file     crypto/x509/x509_obj.c when handling very long ASN1     strings. An unauthenticated, remote attacker can exploit     this to disclose the contents of stack memory.
    (CVE-2016-2176)

  - An overflow condition exists in the Perl-Compatible     Regular Expressions (PCRE) component due to improper     validation of user-supplied input when handling the     (*ACCEPT) verb. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2016-3191)

  - A flaw exists in the libxml2 component in parser.c that     occurs when handling XML content in recovery mode. An     unauthenticated, remote attacker can exploit this to     cause a stack exhaustion, resulting in a denial of     service condition. (CVE-2016-3627)

  - A flaw exists in the libxml2 component in parser.c due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a stack exhaustion, resulting in a denial of     service condition. (CVE-2016-3705)

  - A format string flaw exists in the libxml2 component due     to improper use of string format specifiers (e.g. %s and     %x). An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-4448)

  - An XML external entity injection vulnerability exists in     parser.c due to improper parsing of XML data. An     unauthenticated, remote attacker can exploit this, via     specially crafted XML data, to disclose arbitrary files     or cause a denial of service condition. (CVE-2016-4449)

  - An out-of-bounds read error exists in the libxml2     component in xmlsave.c that occurs when handling XML     content in recovery mode. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-4483)

  - A security bypass vulnerability exists in the libcurl     component due to the program attempting to resume TLS     sessions even if the client certificate fails. An     unauthenticated, remote attacker can exploit this to     bypass validation mechanisms. (CVE-2016-5419)

  - An information disclosure vulnerability exists in the     libcurl component due to the program reusing TLS     connections with different client certificates. An     unauthenticated, remote attacker can exploit this to     disclose sensitive cross-realm information.
    (CVE-2016-5420)

  - A use-after-free error exists in the libcurl component     that is triggered as connection pointers are not     properly cleared for easy handles. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, potentially resulting in the execution of     arbitrary code. (CVE-2016-5421)

  - Multiple stored cross-site scripting (XSS)   	vulnerabilities exist due to improper validation of   	user-supplied input. An authenticated, remote attacker   	can exploit these, via a specially crafted request, to   	execute arbitrary script code in a user's browsers   	session. (CVE-2016-9261)

This update for pcre to version 8.39 (bsc#972127) fixes several issues. If you use pcre extensively please be aware that this is an update to a new version. Please make sure that your software works with the updated version. This version fixes a number of vulnerabilities that affect pcre and applications using the libary when accepting untrusted input as regular expressions or as part thereof. Remote attackers could have caused the application to crash, disclose information or potentially execute arbitrary code. These security issues were fixed :

  - CVE-2014-8964: Heap-based buffer overflow in PCRE     allowed remote attackers to cause a denial of service     (crash) or have other unspecified impact via a crafted     regular expression, related to an assertion that allows     zero repeats (bsc#906574).

  - CVE-2015-2325: Heap buffer overflow in compile_branch()     (bsc#924960).

  - CVE-2015-3210: Heap buffer overflow in pcre_compile2() /     compile_regex() (bsc#933288)

  - CVE-2015-3217: PCRE Library Call Stack Overflow     Vulnerability in match() (bsc#933878).

  - CVE-2015-5073: Library Heap Overflow Vulnerability in     find_fixedlength() (bsc#936227).

  - bsc#942865: heap overflow in compile_regex()

  - CVE-2015-8380: The pcre_exec function in pcre_exec.c     mishandled a // pattern with a \01 string, which allowed     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror (bsc#957566).

  - CVE-2015-2327: PCRE mishandled certain patterns with     internal recursive back references, which allowed remote     attackers to cause a denial of service (segmentation     fault) or possibly have unspecified other impact via a     crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror     (bsc#957567).

  - bsc#957598: Various security issues

  - CVE-2015-8381: Heap Overflow in compile_regex()     (bsc#957598).

  - CVE-2015-8382: Regular Expression Uninitialized Pointer     Information Disclosure Vulnerability     (ZDI-CAN-2547)(bsc#957598).

  - CVE-2015-8383: Buffer overflow caused by repeated     conditional group(bsc#957598).

  - CVE-2015-8384: Buffer overflow caused by recursive back     reference by name within certain group(bsc#957598).

  - CVE-2015-8385: Buffer overflow caused by forward     reference by name to certain group(bsc#957598).

  - CVE-2015-8386: Buffer overflow caused by lookbehind     assertion(bsc#957598).

  - CVE-2015-8387: Integer overflow in subroutine     calls(bsc#957598).

  - CVE-2015-8388: Buffer overflow caused by certain     patterns with an unmatched closing     parenthesis(bsc#957598).

  - CVE-2015-8389: Infinite recursion in JIT compiler when     processing certain patterns(bsc#957598).

  - CVE-2015-8390: Reading from uninitialized memory when     processing certain patterns(bsc#957598).

  - CVE-2015-8391: Some pathological patterns causes     pcre_compile() to run for a very long time(bsc#957598).

  - CVE-2015-8392: Buffer overflow caused by certain     patterns with duplicated named groups(bsc#957598).

  - CVE-2015-8393: Information leak when running pcgrep -q     on crafted binary(bsc#957598).

  - CVE-2015-8394: Integer overflow caused by missing check     for certain conditions(bsc#957598).

  - CVE-2015-8395: Buffer overflow caused by certain     references(bsc#957598).

  - CVE-2015-2328: PCRE mishandled the /((?(R)a|(?1)))+/     pattern and related patterns with certain recursion,     which allowed remote attackers to cause a denial of     service (segmentation fault) or possibly have     unspecified other impact via a crafted regular     expression (bsc#957600).

  - CVE-2016-1283: The pcre_compile2 function in     pcre_compile.c in PCRE mishandled certain patterns with     named subgroups, which allowed remote attackers to cause     a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted     regular expression (bsc#960837).

  - CVE-2016-3191: The compile_branch function in     pcre_compile.c in pcre2_compile.c mishandled patterns     containing an (*ACCEPT) substring in conjunction with     nested parentheses, which allowed remote attackers to     execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted regular     expression (bsc#971741).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for pcre to version 8.39 (bsc#972127) fixes several issues.

If you use pcre extensively please be aware that this is an update to a new version. Please make sure that your software works with the updated version.

This version fixes a number of vulnerabilities that affect pcre and applications using the libary when accepting untrusted input as regular expressions or as part thereof. Remote attackers could have caused the application to crash, disclose information or potentially execute arbitrary code. These security issues were fixed :

  - CVE-2014-8964: Heap-based buffer overflow in PCRE     allowed remote attackers to cause a denial of service     (crash) or have other unspecified impact via a crafted     regular expression, related to an assertion that allows     zero repeats (bsc#906574).

  - CVE-2015-2325: Heap buffer overflow in compile_branch()     (bsc#924960).

  - CVE-2015-3210: Heap buffer overflow in pcre_compile2() /     compile_regex() (bsc#933288)

  - CVE-2015-3217: PCRE Library Call Stack Overflow     Vulnerability in match() (bsc#933878).

  - CVE-2015-5073: Library Heap Overflow Vulnerability in     find_fixedlength() (bsc#936227).

  - bsc#942865: heap overflow in compile_regex()

  - CVE-2015-8380: The pcre_exec function in pcre_exec.c     mishandled a // pattern with a \01 string, which allowed     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror (bsc#957566).

  - CVE-2015-2327: PCRE mishandled certain patterns with     internal recursive back references, which allowed remote     attackers to cause a denial of service (segmentation     fault) or possibly have unspecified other impact via a     crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror     (bsc#957567).

  - bsc#957598: Various security issues 

  - CVE-2015-8381: Heap Overflow in compile_regex()     (bsc#957598).

  - CVE-2015-8382: Regular Expression Uninitialized Pointer     Information Disclosure Vulnerability     (ZDI-CAN-2547)(bsc#957598).

  - CVE-2015-8383: Buffer overflow caused by repeated     conditional group(bsc#957598).

  - CVE-2015-8384: Buffer overflow caused by recursive back     reference by name within certain group(bsc#957598).

  - CVE-2015-8385: Buffer overflow caused by forward     reference by name to certain group(bsc#957598).

  - CVE-2015-8386: Buffer overflow caused by lookbehind     assertion(bsc#957598).

  - CVE-2015-8387: Integer overflow in subroutine     calls(bsc#957598).

  - CVE-2015-8388: Buffer overflow caused by certain     patterns with an unmatched closing     parenthesis(bsc#957598).

  - CVE-2015-8389: Infinite recursion in JIT compiler when     processing certain patterns(bsc#957598).

  - CVE-2015-8390: Reading from uninitialized memory when     processing certain patterns(bsc#957598).

  - CVE-2015-8391: Some pathological patterns causes     pcre_compile() to run for a very long time(bsc#957598).

  - CVE-2015-8392: Buffer overflow caused by certain     patterns with duplicated named groups(bsc#957598).

  - CVE-2015-8393: Information leak when running pcgrep -q     on crafted binary(bsc#957598).

  - CVE-2015-8394: Integer overflow caused by missing check     for certain conditions(bsc#957598).

  - CVE-2015-8395: Buffer overflow caused by certain     references(bsc#957598).

  - CVE-2015-2328: PCRE mishandled the /((?(R)a|(?1)))+/     pattern and related patterns with certain recursion,     which allowed remote attackers to cause a denial of     service (segmentation fault) or possibly have     unspecified other impact via a crafted regular     expression (bsc#957600).

  - CVE-2016-1283: The pcre_compile2 function in     pcre_compile.c in PCRE mishandled certain patterns with     named subgroups, which allowed remote attackers to cause     a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted     regular expression (bsc#960837).

  - CVE-2016-3191: The compile_branch function in     pcre_compile.c in pcre2_compile.c mishandled patterns     containing an (*ACCEPT) substring in conjunction with     nested parentheses, which allowed remote attackers to     execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted regular     expression (bsc#971741).

These non-security issues were fixed :

  - JIT compiler improvements

  - performance improvements

  - The Unicode data tables have been updated to Unicode     7.0.0.

This update was imported from the SUSE:SLE-12:Update update project.

This version fixes a number of vulnerabilities that affect pcre and applications using the libary when accepting untrusted input as regular expressions or as part thereof. Remote attackers could have caused the application to crash, disclose information or potentially execute arbitrary code.

  - Update to PCRE 8.39 FATE#320298 boo#972127.

  - CVE-2015-3210: heap buffer overflow in pcre_compile2() /     compile_regex() (boo#933288)

  - CVE-2015-3217: pcre: PCRE Library Call Stack Overflow     Vulnerability in match() (boo#933878)

  - CVE-2015-5073: pcre: Library Heap Overflow Vulnerability     in find_fixedlength() (boo#936227)

  - boo#942865: heap overflow in compile_regex()

  - CVE-2015-8380: pcre: heap overflow in pcre_exec     (boo#957566)

  - boo#957598: various security issues fixed in pcre 8.37     and 8.38 release

  - CVE-2016-1283: pcre: Heap buffer overflow in     pcre_compile2 causes DoS (boo#960837)

  - CVE-2016-3191: pcre: workspace overflow for (*ACCEPT)     with deeply nested parentheses (boo#971741)

The remote host is affected by the vulnerability described in GLSA-201607-02 (libpcre: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in libpcre. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

New pcre packages are available for Slackware 14.1 and -current to fix security issues.

Mitre reports :

The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles a specific pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possible have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2943-1 advisory.

    It was discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use     this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This release fixes a heap buffer overflow in handling of nested duplicate named groups with a nested back reference and a heap buffer overflow in pcretest causing infinite loop when matching globally with an ovector less than 2.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
193833	RHEL 6 / 7 : rh-mariadb100-mariadb (RHSA-2016:1132)	Nessus	Red Hat Local Security Checks	critical
98857	PHP 7.1.x < 7.1.11 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98845	PHP 7.0.x < 7.0.25 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98823	PHP 5.6.x < 5.6.32 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
105865	Fedora 27 : php (2017-46e8bdccef)	Nessus	Fedora Local Security Checks	critical
104706	Amazon Linux AMI : php56 / php70,php71 (ALAS-2017-924)	Nessus	Amazon Linux Local Security Checks	critical
104640	Tenable SecurityCenter PHP < 5.6.32 PCRE DoS	Nessus	Misc.	critical
104633	PHP 7.1.x < 7.1.11 Multiple Vulnerabilities	Nessus	CGI abuses	critical
104632	PHP 7.0.x < 7.0.25 Multiple Vulnerabilities	Nessus	CGI abuses	critical
104631	PHP 5.6.x < 5.6.32 Multiple Vulnerabilities	Nessus	CGI abuses	critical
104451	Fedora 25 : php (2017-cdaaf6ea12)	Nessus	Fedora Local Security Checks	critical
104443	Fedora 26 : php (2017-0af85ae851)	Nessus	Fedora Local Security Checks	critical
104266	FreeBSD : PHP -- denial of service attack (de7a2b32-bd7d-11e7-b627-d43d7e971a1b)	Nessus	FreeBSD Local Security Checks	critical
104215	Slackware 14.0 / 14.1 / 14.2 / current : php (SSA:2017-300-01)	Nessus	Slackware Local Security Checks	critical
97893	Tenable Log Correlation Engine (LCE) < 4.8.1 Multiple Vulnerabilities	Nessus	Misc.	critical
95915	SUSE SLED12 / SLES12 Security Update : pcre (SUSE-SU-2016:3161-1)	Nessus	SuSE Local Security Checks	critical
95754	openSUSE Security Update : pcre (openSUSE-2016-1448)	Nessus	SuSE Local Security Checks	critical
95534	SUSE SLED12 / SLES12 Security Update : pcre (SUSE-SU-2016:2971-1)	Nessus	SuSE Local Security Checks	critical
94906	openSUSE Security Update : pcre (openSUSE-2016-1303)	Nessus	SuSE Local Security Checks	critical
91983	GLSA-201607-02 : libpcre: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
91719	Slackware 14.1 / current : pcre (SSA:2016-172-02)	Nessus	Slackware Local Security Checks	critical
90336	FreeBSD : pcre -- heap overflow vulnerability (497b82e0-f9a0-11e5-92ce-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical
90306	Ubuntu 14.04 LTS : PCRE vulnerabilities (USN-2943-1)	Nessus	Ubuntu Local Security Checks	critical
89948	Fedora 22 : pcre-8.38-3.fc22 (2016-f5af8e27ce)	Nessus	Fedora Local Security Checks	critical
89557	Fedora 23 : pcre-8.38-6.fc23 (2016-65833b5dbc)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2016-1283

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical