Perl Compatible Regular Expression Library vulnerabilities

Product

Perl Compatible Regular Expression Library

by Pcre · last CVE Dec 2, 2015

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities17 In the news0 Timeline

Severity mix

Critical 5High 2Medium 0Low 0

Severity

All severities17 Critical5 High2 Medium0 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Perl Compatible Regular Expression Library to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2015-8394	9.8	5%	Dec 2	PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have… Affected: through 8.37
CVE-2015-8390	9.8	5%	Dec 2	PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have… Affected: through 8.37
CVE-2015-8389	9.8	4%	Dec 2	PCRE before 8.38 mishandles the /(?:\|a\|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have… Affected: through 8.37
CVE-2015-8386	9.8	7%	Dec 2	PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer… Affected: through 8.37
CVE-2015-8383	9.8	6%	Dec 2	PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other… Affected: through 8.37
CVE-2015-8393	7.5	4%	Dec 2	pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a… Affected: through 8.37
CVE-2015-8387	7.3	4%	Dec 2	PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have… Affected: through 8.37
CVE-2015-8395	–	4%	Dec 2	PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular… Affected: through 8.37
CVE-2015-8392	–	4%	Dec 2	PCRE before 8.38 mishandles certain instances of the (?\| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or… Affected: through 8.37
CVE-2015-8388	–	7%	Dec 2	PCRE before 8.38 mishandles the /(?=di(?<=(?1))\|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of… Affected: through 8.37
CVE-2015-8385	–	6%	Dec 2	PCRE before 8.38 mishandles the /(?\|(\k'Pm')\|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service… Affected: through 8.37
CVE-2015-8384	–	3%	Dec 2	PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of… Affected: through 8.37
CVE-2015-8382	–	4%	Dec 2	The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))\|(((?:(?:(?:(?:abc\|(?:abcdef))))b)abcdefghi)abc)\|((*ACCEPT)))/ pattern and related patterns… Affected: 8.36
CVE-2015-8381	–	5%	Dec 2	The compile_regex function in pcre_compile.c in PCRE before 8.38 and pcre2_compile.c in PCRE2 before 10.2x mishandles the /(?J:(?\|(:(?\|(?'R')(\k'R')\|((?'R')))H'Rk'Rf)\|s(?'R'))))/… Affected: through 8.37
CVE-2015-8380	–	4%	Dec 2	The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer… Affected: through 8.37
CVE-2015-2327	–	4%	Dec 2	PCRE before 8.36 mishandles the /(((a\2)\|(a)\g<-1>))/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a… Affected: through 8.35
CVE-2007-1661	–	2%	Nov 7	Perl-Compatible Regular Expression (PCRE) library before 7.3 backtracks too far when matching certain input bytes against some regex patterns in non-UTF-8 mode, which allows… Affected: through 7.2; 7.0; 7.1