CVE-2015-3210

CRITICAL 9.8CVE-2015-3210 · Published 13/12/2016 · updated 17/06/2026

In short

CVE-2015-3210 is a CRITICAL (CVSS 9.8) vulnerability affecting pcre (pcre), pcre2 (pcre).
Chance of exploitation in the next 30 days (EPSS): 9.2%, higher than 95.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
pcre pcre	`= 8.34= 8.35= 8.36= 8.37`	No fix yet
pcre2 pcre	`= 10.10`	No fix yet

Description

Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/, a different vulnerability than CVE-2015-8384.

References

rhn.redhat.com/errata/RHSA-2016-2750.html · Third Party Advisory
openwall.com/lists/oss-security/2015/06/01/7 · Mailing List
openwall.com/lists/oss-security/2015/12/02/11 · Mailing List
securityfocus.com/bid/74934 · Broken Link
access.redhat.com/errata/RHSA-2016:1132 · Third Party Advisory
bugs.exim.org/show_bug.cgi · Exploit

More vulnerabilities in pcre

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

pcre

= 8.34= 8.35= 8.36= 8.37

No fix yet

pcre2

pcre

= 10.10

No fix yet

More vulnerabilities in pcre

See all →