The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1132 advisory.

  - pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4)     (CVE-2015-3210, CVE-2015-8384)

  - pcre: stack overflow caused by mishandled group empty match (8.38/11) (CVE-2015-3217)

  - mysql: unspecified vulnerability related to Server:Partition (CPU October 2015) (CVE-2015-4792,     CVE-2015-4802)

  - mysql: unspecified vulnerability related to Server:DDL (CPU October 2015) (CVE-2015-4815)

  - mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015) (CVE-2015-4816,     CVE-2015-4861, CVE-2015-4895)

  - mysql: unspecified vulnerability related to Client programs (CPU October 2015) (CVE-2015-4819)

  - mysql: unspecified vulnerability related to Server:Types (CPU October 2015) (CVE-2015-4826)

  - mysql: unspecified vulnerability related to Server:Security:Privileges (CPU October 2015) (CVE-2015-4830)

  - mysql: unspecified vulnerability related to Server:SP (CPU October 2015) (CVE-2015-4836)

  - mysql: unspecified vulnerability related to Server:DML (CPU October 2015) (CVE-2015-4858, CVE-2015-4879,     CVE-2015-4913)

  - mysql: unspecified vulnerability related to Server:Parser (CPU October 2015) (CVE-2015-4870)

  - pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis     (8.38/18) (CVE-2015-5073, CVE-2015-8388)

  - pcre: Buffer overflow caused by duplicate named references (8.38/36) (CVE-2015-8381, CVE-2015-8395)

  - pcre: Buffer overflow caused by repeated conditional group (8.38/3) (CVE-2015-8383)

  - pcre: buffer overflow caused by named forward reference to duplicate group number (8.38/30)     (CVE-2015-8385)

  - pcre: Buffer overflow caused by lookbehind assertion (8.38/6) (CVE-2015-8386)

  - pcre: inefficient posix character class syntax check (8.38/16) (CVE-2015-8391)

  - pcre: buffer overflow caused by patterns with duplicated named groups with (?| (8.38/27) (CVE-2015-8392)

  - mysql: unspecified vulnerability in subcomponent: Server: Options (CPU January 2016) (CVE-2016-0505)

  - mysql: unspecified vulnerability in subcomponent: Client (CPU January 2016) (CVE-2016-0546)

  - mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016) (CVE-2016-0596,     CVE-2016-0598)

  - mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016) (CVE-2016-0597,     CVE-2016-0616)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU January 2016) (CVE-2016-0600,     CVE-2016-0610)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU January 2016)     (CVE-2016-0606)

  - mysql: unspecified vulnerability in subcomponent: Server: UDF (CPU January 2016) (CVE-2016-0608)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU January 2016)     (CVE-2016-0609)

  - mysql: unspecified vulnerability in subcomponent: Server: DML (CPU April 2016) (CVE-2016-0640,     CVE-2016-0643, CVE-2016-0646)

  - mysql: unspecified vulnerability in subcomponent: Server: MyISAM (CPU April 2016) (CVE-2016-0641)

  - mysql: unspecified vulnerability in subcomponent: Server: Federated (CPU April 2016) (CVE-2016-0642)

  - mysql: unspecified vulnerability in subcomponent: Server: DDL (CPU April 2016) (CVE-2016-0644)

  - mysql: unspecified vulnerability in subcomponent: Server: FTS (CPU April 2016) (CVE-2016-0647)

  - mysql: unspecified vulnerability in subcomponent: Server: PS (CPU April 2016) (CVE-2016-0648,     CVE-2016-0649)

  - mysql: unspecified vulnerability in subcomponent: Server: Replication (CPU April 2016) (CVE-2016-0650)

  - mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016) (CVE-2016-0651)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU April 2016) (CVE-2016-0655,     CVE-2016-0668)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU April 2016)     (CVE-2016-0666)

  - pcre: heap buffer overflow in handling of duplicate named groups (8.39/14) (CVE-2016-1283)

  - mysql: ssl-validate-cert incorrect hostname check (CVE-2016-2047)

  - pcre: workspace overflow for (*ACCEPT) with deeply nested parentheses (8.39/13, 10.22/12) (CVE-2016-3191)

  - mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU July 2016)     (CVE-2016-3452)

  - mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU July 2016) (CVE-2016-3459)

  - mysql: unspecified vulnerability in subcomponent: Server: Option (CPU July 2016) (CVE-2016-3471)

  - mysql: unspecified vulnerability in subcomponent: Server: Connection (CPU July 2016) (CVE-2016-5444)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the pcre packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/     pattern and related patterns with certain recursion,     which allows remote attackers to cause a denial of     service (segmentation fault) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror.(CVE-2015-2328)

  - PCRE before 8.38 mishandles the : and \\\\ substrings     in character classes, which allows remote attackers to     cause a denial of service (uninitialized memory read)     or possibly have unspecified other impact via a crafted     regular expression, as demonstrated by a JavaScript     RegExp object encountered by Konqueror.(CVE-2015-8390)

  - Heap-based buffer overflow in the find_fixedlength     function in pcre_compile.c in PCRE before 8.38 allows     remote attackers to cause a denial of service (crash)     or obtain sensitive information from heap memory and     possibly bypass the ASLR protection mechanism via a     crafted regular expression with an excess closing     parenthesis.(CVE-2015-5073)

  - PCRE before 8.38 mishandles (?123) subroutine calls and     related subroutine calls, which allows remote attackers     to cause a denial of service (integer overflow) or     possibly have unspecified other impact via a crafted     regular expression, as demonstrated by a JavaScript     RegExp object encountered by Konqueror.(CVE-2015-8387)

  - The pcre_exec function in pcre_exec.c in PCRE before     8.38 mishandles a // pattern with a \\01 string, which     allows remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror.(CVE-2015-8380)

  - The compile_branch function in pcre_compile.c in PCRE     8.x before 8.39 and pcre2_compile.c in PCRE2 before     10.22 mishandles patterns containing an (*ACCEPT)     substring in conjunction with nested parentheses, which     allows remote attackers to execute arbitrary code or     cause a denial of service (stack-based buffer overflow)     via a crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror, aka     ZDI-CAN-3542.(CVE-2016-3191)

  - The pcre_compile function in pcre_compile.c in PCRE     before 8.38 mishandles certain : nesting, which allows     remote attackers to cause a denial of service (CPU     consumption) or possibly have unspecified other impact     via a crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by     Konqueror.(CVE-2015-8391)

  - PCRE before 8.36 mishandles the     /(((a\\2)|(a*)\\gi1/4oe-1i1/4z))*/ pattern and related     patterns with certain internal recursive back     references, which allows remote attackers to cause a     denial of service (segmentation fault) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror.(CVE-2015-2327)

  - PCRE before 8.38 mishandles the (?(i1/4oedigitsi1/4z) and     (?(Ri1/4oedigitsi1/4z) conditions, which allows remote     attackers to cause a denial of service (integer     overflow) or possibly have unspecified other impact via     a crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by     Konqueror.(CVE-2015-8394)

  - PCRE before 8.38 mishandles the     /(?=di(?i1/4oe=(?1))|(?=(.))))/ pattern and related     patterns with an unmatched closing parenthesis, which     allows remote attackers to cause a denial of service     (buffer overflow) or possibly have unspecified other     impact via a crafted regular expression, as     demonstrated by a JavaScript RegExp object encountered     by Konqueror.(CVE-2015-8388)

  - PCRE before 8.38 mishandles the interaction of     lookbehind assertions and mutually recursive     subpatterns, which allows remote attackers to cause a     denial of service (buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror.(CVE-2015-8386)

  - PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10     mishandle group empty matches, which might allow remote     attackers to cause a denial of service (stack-based     buffer overflow) via a crafted regular expression, as     demonstrated by     /^(?:(?(1)\\\\.|(^\\\\\\\\W_)?)+)+$/.(CVE-2015-3217)

  - PCRE before 8.38 mishandles the /(?|(\\k'Pm')|(?'Pm'))/     pattern and related patterns with certain forward     references, which allows remote attackers to cause a     denial of service (buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror.(CVE-2015-8385)

  - A flaw was found in the way PCRE handled certain     malformed regular expressions. This issue could cause     an application (for example, Konqueror) linked against     PCRE to crash while parsing malicious regular     expressions.(CVE-2014-8964)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The compile_branch function in pcre_compile.c in PCRE 8.x and pcre2_compile.c in PCRE2 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.(CVE-2016-3191)

According to the versions of the pcre packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the way PCRE handled     malformed regular expressions. An attacker able to make     an application using PCRE process a specially crafted     regular expression could use these flaws to cause the     application to crash or, possibly, execute arbitrary     code. (CVE-2015-8385, CVE-2016-3191, CVE-2015-2328,     CVE-2015-3217, CVE-2015-5073, CVE-2015-8388,     CVE-2015-8391, CVE-2015-8386)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tenable Log Correlation Engine (LCE) installed on the remote host is prior to 4.8.1. It is, therefore, affected by the following vulnerabilities :

  - Multiple cross-site scripting (XSS) vulnerabilities     exist in the Handlebars library in the     lib/handlebars/utils.js script due to a failure to     properly escape input passed as unquoted attributes to     templates. An unauthenticated, remote attacker can     exploit these vulnerabilities, via a specially crafted     request, to execute arbitrary script code in a user's     browser session. (CVE-2015-8861, CVE-2015-8862)

  - A heap-based buffer overflow condition exists in the     Perl-Compatible Regular Expressions (PCRE) component     that is triggered when processing nested back references     in a duplicate named group. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1283)

  - An out-of-bounds read error exists in the libxml2     component in parserInternals.c due to improper parsing     of characters in an XML file. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-1833)

  - An overflow condition exists in the libxml2 component in     xmlstring.c due to improper validation of user-supplied     input when handling a string with NULL. An     unauthenticated, remote attacker can exploit this, via a     specially crafted file, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1834)

  - Multiple use-after-free errors exist in the libxml2     component in parser.c that is triggered when parsing     complex names. An unauthenticated, remote attacker can     exploit these issues, via a specially crafted file, to     dereference already freed memory and potentially execute     arbitrary code. (CVE-2016-1835, CVE-2016-1836)

  - Multiple heap-based buffer overflow conditions exist in     the libxml2 component in HTMLparser.c and xmlregexp.c     due to improper validation of user-supplied input when     parsing characters in a range. An unauthenticated,     remote attacker can exploit these issues, via a     specially crafted file, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1837, CVE-2016-1839, CVE-2016-1840)

  - Multiple out-of-bounds read errors exist in the libxml2     component in parser.c. An unauthenticated, remote     attacker can exploit these issues to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-1838, CVE-2016-4447)

  - A heap buffer overflow condition exists in the OpenSSL     component in the EVP_EncodeUpdate() function within file     crypto/evp/encode.c that is triggered when handling a     large amount of input data. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition. (CVE-2016-2105)

  - A heap buffer overflow condition exists in the OpenSSL     component in the EVP_EncryptUpdate() function within     file crypto/evp/evp_enc.c that is triggered when     handling a large amount of input data after a previous     call occurs to the same function with a partial block.
    An unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2016-2106)

  - Flaws exist in the aesni_cbc_hmac_sha1_cipher()     function in file crypto/evp/e_aes_cbc_hmac_sha1.c and     the aesni_cbc_hmac_sha256_cipher() function in file     crypto/evp/e_aes_cbc_hmac_sha256.c that are triggered     when the connection uses an AES-CBC cipher and AES-NI     is supported by the server. A man-in-the-middle attacker     can exploit these to conduct a padding oracle attack,     resulting in the ability to decrypt the network traffic.
    (CVE-2016-2107)

  - A remote code execution vulnerability exists in the     OpenSSL component in the ASN.1 encoder due to an     underflow condition that occurs when attempting to     encode the value zero represented as a negative integer.
    An unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in the execution of arbitrary     code. (CVE-2016-2108)

  - Multiple unspecified flaws exist in the d2i BIO     functions when reading ASN.1 data from a BIO due to     invalid encoding causing a large allocation of memory.
    An unauthenticated, remote attacker can exploit these to     cause a denial of service condition through resource     exhaustion. (CVE-2016-2109)

  - An out-of-bounds read error exists in the     X509_NAME_oneline() function within file     crypto/x509/x509_obj.c when handling very long ASN1     strings. An unauthenticated, remote attacker can exploit     this to disclose the contents of stack memory.
    (CVE-2016-2176)

  - An overflow condition exists in the Perl-Compatible     Regular Expressions (PCRE) component due to improper     validation of user-supplied input when handling the     (*ACCEPT) verb. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2016-3191)

  - A flaw exists in the libxml2 component in parser.c that     occurs when handling XML content in recovery mode. An     unauthenticated, remote attacker can exploit this to     cause a stack exhaustion, resulting in a denial of     service condition. (CVE-2016-3627)

  - A flaw exists in the libxml2 component in parser.c due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a stack exhaustion, resulting in a denial of     service condition. (CVE-2016-3705)

  - A format string flaw exists in the libxml2 component due     to improper use of string format specifiers (e.g. %s and     %x). An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-4448)

  - An XML external entity injection vulnerability exists in     parser.c due to improper parsing of XML data. An     unauthenticated, remote attacker can exploit this, via     specially crafted XML data, to disclose arbitrary files     or cause a denial of service condition. (CVE-2016-4449)

  - An out-of-bounds read error exists in the libxml2     component in xmlsave.c that occurs when handling XML     content in recovery mode. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-4483)

  - A security bypass vulnerability exists in the libcurl     component due to the program attempting to resume TLS     sessions even if the client certificate fails. An     unauthenticated, remote attacker can exploit this to     bypass validation mechanisms. (CVE-2016-5419)

  - An information disclosure vulnerability exists in the     libcurl component due to the program reusing TLS     connections with different client certificates. An     unauthenticated, remote attacker can exploit this to     disclose sensitive cross-realm information.
    (CVE-2016-5420)

  - A use-after-free error exists in the libcurl component     that is triggered as connection pointers are not     properly cleared for easy handles. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, potentially resulting in the execution of     arbitrary code. (CVE-2016-5421)

  - Multiple stored cross-site scripting (XSS)   	vulnerabilities exist due to improper validation of   	user-supplied input. An authenticated, remote attacker   	can exploit these, via a specially crafted request, to   	execute arbitrary script code in a user's browsers   	session. (CVE-2016-9261)

This update for pcre to version 8.39 (bsc#972127) fixes several issues. If you use pcre extensively please be aware that this is an update to a new version. Please make sure that your software works with the updated version. This version fixes a number of vulnerabilities that affect pcre and applications using the libary when accepting untrusted input as regular expressions or as part thereof. Remote attackers could have caused the application to crash, disclose information or potentially execute arbitrary code. These security issues were fixed :

  - CVE-2014-8964: Heap-based buffer overflow in PCRE     allowed remote attackers to cause a denial of service     (crash) or have other unspecified impact via a crafted     regular expression, related to an assertion that allows     zero repeats (bsc#906574).

  - CVE-2015-2325: Heap buffer overflow in compile_branch()     (bsc#924960).

  - CVE-2015-3210: Heap buffer overflow in pcre_compile2() /     compile_regex() (bsc#933288)

  - CVE-2015-3217: PCRE Library Call Stack Overflow     Vulnerability in match() (bsc#933878).

  - CVE-2015-5073: Library Heap Overflow Vulnerability in     find_fixedlength() (bsc#936227).

  - bsc#942865: heap overflow in compile_regex()

  - CVE-2015-8380: The pcre_exec function in pcre_exec.c     mishandled a // pattern with a \01 string, which allowed     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror (bsc#957566).

  - CVE-2015-2327: PCRE mishandled certain patterns with     internal recursive back references, which allowed remote     attackers to cause a denial of service (segmentation     fault) or possibly have unspecified other impact via a     crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror     (bsc#957567).

  - bsc#957598: Various security issues

  - CVE-2015-8381: Heap Overflow in compile_regex()     (bsc#957598).

  - CVE-2015-8382: Regular Expression Uninitialized Pointer     Information Disclosure Vulnerability     (ZDI-CAN-2547)(bsc#957598).

  - CVE-2015-8383: Buffer overflow caused by repeated     conditional group(bsc#957598).

  - CVE-2015-8384: Buffer overflow caused by recursive back     reference by name within certain group(bsc#957598).

  - CVE-2015-8385: Buffer overflow caused by forward     reference by name to certain group(bsc#957598).

  - CVE-2015-8386: Buffer overflow caused by lookbehind     assertion(bsc#957598).

  - CVE-2015-8387: Integer overflow in subroutine     calls(bsc#957598).

  - CVE-2015-8388: Buffer overflow caused by certain     patterns with an unmatched closing     parenthesis(bsc#957598).

  - CVE-2015-8389: Infinite recursion in JIT compiler when     processing certain patterns(bsc#957598).

  - CVE-2015-8390: Reading from uninitialized memory when     processing certain patterns(bsc#957598).

  - CVE-2015-8391: Some pathological patterns causes     pcre_compile() to run for a very long time(bsc#957598).

  - CVE-2015-8392: Buffer overflow caused by certain     patterns with duplicated named groups(bsc#957598).

  - CVE-2015-8393: Information leak when running pcgrep -q     on crafted binary(bsc#957598).

  - CVE-2015-8394: Integer overflow caused by missing check     for certain conditions(bsc#957598).

  - CVE-2015-8395: Buffer overflow caused by certain     references(bsc#957598).

  - CVE-2015-2328: PCRE mishandled the /((?(R)a|(?1)))+/     pattern and related patterns with certain recursion,     which allowed remote attackers to cause a denial of     service (segmentation fault) or possibly have     unspecified other impact via a crafted regular     expression (bsc#957600).

  - CVE-2016-1283: The pcre_compile2 function in     pcre_compile.c in PCRE mishandled certain patterns with     named subgroups, which allowed remote attackers to cause     a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted     regular expression (bsc#960837).

  - CVE-2016-3191: The compile_branch function in     pcre_compile.c in pcre2_compile.c mishandled patterns     containing an (*ACCEPT) substring in conjunction with     nested parentheses, which allowed remote attackers to     execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted regular     expression (bsc#971741).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for pcre to version 8.39 (bsc#972127) fixes several issues.

If you use pcre extensively please be aware that this is an update to a new version. Please make sure that your software works with the updated version.

This version fixes a number of vulnerabilities that affect pcre and applications using the libary when accepting untrusted input as regular expressions or as part thereof. Remote attackers could have caused the application to crash, disclose information or potentially execute arbitrary code. These security issues were fixed :

  - CVE-2014-8964: Heap-based buffer overflow in PCRE     allowed remote attackers to cause a denial of service     (crash) or have other unspecified impact via a crafted     regular expression, related to an assertion that allows     zero repeats (bsc#906574).

  - CVE-2015-2325: Heap buffer overflow in compile_branch()     (bsc#924960).

  - CVE-2015-3210: Heap buffer overflow in pcre_compile2() /     compile_regex() (bsc#933288)

  - CVE-2015-3217: PCRE Library Call Stack Overflow     Vulnerability in match() (bsc#933878).

  - CVE-2015-5073: Library Heap Overflow Vulnerability in     find_fixedlength() (bsc#936227).

  - bsc#942865: heap overflow in compile_regex()

  - CVE-2015-8380: The pcre_exec function in pcre_exec.c     mishandled a // pattern with a \01 string, which allowed     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror (bsc#957566).

  - CVE-2015-2327: PCRE mishandled certain patterns with     internal recursive back references, which allowed remote     attackers to cause a denial of service (segmentation     fault) or possibly have unspecified other impact via a     crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror     (bsc#957567).

  - bsc#957598: Various security issues 

  - CVE-2015-8381: Heap Overflow in compile_regex()     (bsc#957598).

  - CVE-2015-8382: Regular Expression Uninitialized Pointer     Information Disclosure Vulnerability     (ZDI-CAN-2547)(bsc#957598).

  - CVE-2015-8383: Buffer overflow caused by repeated     conditional group(bsc#957598).

  - CVE-2015-8384: Buffer overflow caused by recursive back     reference by name within certain group(bsc#957598).

  - CVE-2015-8385: Buffer overflow caused by forward     reference by name to certain group(bsc#957598).

  - CVE-2015-8386: Buffer overflow caused by lookbehind     assertion(bsc#957598).

  - CVE-2015-8387: Integer overflow in subroutine     calls(bsc#957598).

  - CVE-2015-8388: Buffer overflow caused by certain     patterns with an unmatched closing     parenthesis(bsc#957598).

  - CVE-2015-8389: Infinite recursion in JIT compiler when     processing certain patterns(bsc#957598).

  - CVE-2015-8390: Reading from uninitialized memory when     processing certain patterns(bsc#957598).

  - CVE-2015-8391: Some pathological patterns causes     pcre_compile() to run for a very long time(bsc#957598).

  - CVE-2015-8392: Buffer overflow caused by certain     patterns with duplicated named groups(bsc#957598).

  - CVE-2015-8393: Information leak when running pcgrep -q     on crafted binary(bsc#957598).

  - CVE-2015-8394: Integer overflow caused by missing check     for certain conditions(bsc#957598).

  - CVE-2015-8395: Buffer overflow caused by certain     references(bsc#957598).

  - CVE-2015-2328: PCRE mishandled the /((?(R)a|(?1)))+/     pattern and related patterns with certain recursion,     which allowed remote attackers to cause a denial of     service (segmentation fault) or possibly have     unspecified other impact via a crafted regular     expression (bsc#957600).

  - CVE-2016-1283: The pcre_compile2 function in     pcre_compile.c in PCRE mishandled certain patterns with     named subgroups, which allowed remote attackers to cause     a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted     regular expression (bsc#960837).

  - CVE-2016-3191: The compile_branch function in     pcre_compile.c in pcre2_compile.c mishandled patterns     containing an (*ACCEPT) substring in conjunction with     nested parentheses, which allowed remote attackers to     execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted regular     expression (bsc#971741).

These non-security issues were fixed :

  - JIT compiler improvements

  - performance improvements

  - The Unicode data tables have been updated to Unicode     7.0.0.

This update was imported from the SUSE:SLE-12:Update update project.

This version fixes a number of vulnerabilities that affect pcre and applications using the libary when accepting untrusted input as regular expressions or as part thereof. Remote attackers could have caused the application to crash, disclose information or potentially execute arbitrary code.

  - Update to PCRE 8.39 FATE#320298 boo#972127.

  - CVE-2015-3210: heap buffer overflow in pcre_compile2() /     compile_regex() (boo#933288)

  - CVE-2015-3217: pcre: PCRE Library Call Stack Overflow     Vulnerability in match() (boo#933878)

  - CVE-2015-5073: pcre: Library Heap Overflow Vulnerability     in find_fixedlength() (boo#936227)

  - boo#942865: heap overflow in compile_regex()

  - CVE-2015-8380: pcre: heap overflow in pcre_exec     (boo#957566)

  - boo#957598: various security issues fixed in pcre 8.37     and 8.38 release

  - CVE-2016-1283: pcre: Heap buffer overflow in     pcre_compile2 causes DoS (boo#960837)

  - CVE-2016-3191: pcre: workspace overflow for (*ACCEPT)     with deeply nested parentheses (boo#971741)

This update for pcre2 fixes the following issues :

  - pcre2 10.22 :

  - The POSIX wrapper function regcomp() did not used to     support back references and subroutine calls if called     with the REG_NOSUB option. It now does.

  - A new function, pcre2_code_copy(), is added, to make a     copy of a compiled pattern.

  - Support for string callouts is added to pcre2grep.

  - Added the PCRE2_NO_JIT option to pcre2_match().

  - The pcre2_get_error_message() function now returns with     a negative error code if the error number it is given is     unknown.

  - Several updates have been made to pcre2test and test     scripts

  - Fix CVE-2016-3191: workspace overflow for (*ACCEPT) with     deeply nested parentheses (boo#971741)

  - Update to new upstream release 10.21

  - Improve JIT matching speed of patterns starting with +     or *.

  - Use memchr() to find the first character in an     unanchored match in 8-bit mode in the interpreter. This     gives a significant speed improvement.

  - 10.20 broke the handling of [[:>:]] and [[:<:]] in that     processing them could involve a buffer overflow if the     following character was an opening parenthesis.

  - 10.20 also introduced a bug in processing this pattern:
    /((?x)(*:0))#(?'/, which was fixed.

  - A callout with a string argument containing an opening     square bracket, for example /(?C$[$)(?<]/, was     incorrectly processed and could provoke a buffer     overflow.

  - A possessively repeated conditional group that could     match an empty string, for example, /(?(R))*+/, was     incorrectly compiled.

  - The Unicode tables have been updated to Unicode 8.0.0.

  - An empty comment (?#) in a pattern was incorrectly     processed and could provoke a buffer overflow.

  - Fix infinite recursion in the JIT compiler when certain     patterns /such as (?:|a|)(100)x/ are analysed.

  - Some patterns with character classes involving [: and \\     were incorrectly compiled and could cause reading from     uninitialized memory or an incorrect error diagnosis.
    Examples are: /[[:\\](?<[::]/ and /[[:\\](?'abc')[a:].

  - A missing closing parenthesis for a callout with a     string argument was not being diagnosed, possibly     leading to a buffer overflow.

  - If (?R was followed by - or + incorrect behaviour     happened instead of a diagnostic.

  - Fixed an issue when \p(Any) inside an xclass did not     read the current character.

  - About 80 more fixes, which you can read about in the     ChangeLog shipped with the libpcre2-8-0 package.

An update for pcre is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

PCRE is a Perl-compatible regular expression library.

Security Fix(es) :

* Multiple flaws were found in the way PCRE handled malformed regular expressions. An attacker able to make an application using PCRE process a specially crafted regular expression could use these flaws to cause the application to crash or, possibly, execute arbitrary code. (CVE-2015-8385, CVE-2016-3191, CVE-2015-2328, CVE-2015-3217, CVE-2015-5073, CVE-2015-8388, CVE-2015-8391, CVE-2015-8386)

Security Fix(es) :

  - Multiple flaws were found in the way PCRE handled     malformed regular expressions. An attacker able to make     an application using PCRE process a specially crafted     regular expression could use these flaws to cause the     application to crash or, possibly, execute arbitrary     code. (CVE-2015-8385, CVE-2016-3191, CVE-2015-2328,     CVE-2015-3217, CVE-2015-5073, CVE-2015-8388,     CVE-2015-8391, CVE-2015-8386)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1025 advisory.

    - Fix CVE-2015-2328 (infinite recursion compiling pattern with recursive       reference in a group with indefinite repeat) (bug #1330508)
    - Fix CVE-2015-8385 (buffer overflow caused by named forward reference to       duplicate group number) (bug #1330508)
    - Fix CVE-2015-8386 (buffer overflow caused by lookbehind assertion)       (bug #1330508)
    - Fix CVE-2015-3217 (stack overflow caused by mishandled group empty match)       (bug #1330508)
    - Fix CVE-2015-5073 and CVE-2015-8388 (buffer overflow for forward reference       within backward assertion with excess closing parenthesis) (bug #1330508)
    - Fix CVE-2015-8391 (inefficient posix character class syntax check)       (bug #1330508)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2943-1 advisory.

    It was discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use     this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Philip Hazel reports :

PCRE does not validate that handling the (*ACCEPT) verb will occur within the bounds of the cworkspace stack buffer, leading to a stack buffer overflow.

ID	Name	Product	Family	Severity
193833	RHEL 6 / 7 : rh-mariadb100-mariadb (RHSA-2016:1132)	Nessus	Red Hat Local Security Checks	critical
125102	EulerOS Virtualization 3.0.1.0 : pcre (EulerOS-SA-2019-1558)	Nessus	Huawei Local Security Checks	critical
117348	Amazon Linux AMI : pcre (ALAS-2018-1076)	Nessus	Amazon Linux Local Security Checks	critical
99786	EulerOS 2.0 SP1 : pcre (EulerOS-SA-2016-1023)	Nessus	Huawei Local Security Checks	critical
97893	Tenable Log Correlation Engine (LCE) < 4.8.1 Multiple Vulnerabilities	Nessus	Misc.	critical
95915	SUSE SLED12 / SLES12 Security Update : pcre (SUSE-SU-2016:3161-1)	Nessus	SuSE Local Security Checks	critical
95754	openSUSE Security Update : pcre (openSUSE-2016-1448)	Nessus	SuSE Local Security Checks	critical
95534	SUSE SLED12 / SLES12 Security Update : pcre (SUSE-SU-2016:2971-1)	Nessus	SuSE Local Security Checks	critical
94906	openSUSE Security Update : pcre (openSUSE-2016-1303)	Nessus	SuSE Local Security Checks	critical
92974	openSUSE Security Update : pcre2 (openSUSE-2016-966)	Nessus	SuSE Local Security Checks	critical
91104	CentOS 7 : pcre (CESA-2016:1025)	Nessus	CentOS Local Security Checks	critical
91081	Scientific Linux Security Update : pcre on SL7.x x86_64 (20160511)	Nessus	Scientific Linux Local Security Checks	critical
91078	RHEL 7 : pcre (RHSA-2016:1025)	Nessus	Red Hat Local Security Checks	critical
91072	Oracle Linux 7 : pcre (ELSA-2016-1025)	Nessus	Oracle Linux Local Security Checks	critical
90306	Ubuntu 14.04 LTS : PCRE vulnerabilities (USN-2943-1)	Nessus	Ubuntu Local Security Checks	critical
90050	FreeBSD : pcre -- stack buffer overflow (7033b42d-ef09-11e5-b766-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2016-3191

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical