CVE-2015-8380

HIGH 7.5CVE-2015-8380 · Published 02/12/2015 · updated 17/06/2026

In short

CVE-2015-8380 is a HIGH (CVSS 7.5) vulnerability affecting perl compatible regular expression library (pcre).
Chance of exploitation in the next 30 days (EPSS): 4.4%, higher than 91.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
perl compatible regular expression library pcre	`≤ 8.37`	No fix yet

Description

The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

References

lists.fedoraproject.org/pipermail/package-announce/2015-December/173700.html · Third Party Advisory
vcs.pcre.org/pcre/code/trunk/ChangeLog · Exploit
openwall.com/lists/oss-security/2015/11/29/1 · Exploit
securityfocus.com/bid/77695 · Third Party Advisory
blog.fuzzing-project.org/29-Heap-Overflow-in-PCRE.html · Third Party Advisory
bto.bluecoat.com/security-advisory/sa128 · Third Party Advisory
bugs.exim.org/show_bug.cgi · Exploit
security.gentoo.org/glsa/201607-02

More vulnerabilities in perl compatible regular expression library

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

perl compatible regular expression library

pcre

≤ 8.37

No fix yet

Description

More vulnerabilities in perl compatible regular expression library

See all →