Bug 1237223 (CVE-2015-5073, CVE-2015-8388)

Summary:	CVE-2015-5073 CVE-2015-8388 pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis (8.38/18)
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adam.stokes, andrew, c.david86, erik-fedora, jgrulich, jorton, lkundrak, mclasen, mmaslano, ppisar, rcollet, sardella, slawomir, walters, webstack-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	pcre 8.38	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-15 13:29:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1237224, 1237225, 1330455, 1330456, 1330508, 1330509
Bug Blocks:	1287727

Description Vasyl Kaigorodov 2015-06-30 14:47:20 UTC

Quoting http://www.openwall.com/lists/oss-security/2015/06/26/1:

"""
PCRE is a regular expression C library inspired by the regular expression
capabilities in the Perl programming language.
The PCRE library is incorporated into a number of prominent programs, such
as Adobe Flash, Apache, Nginx, PHP.

PCRE library is prone to a vulnerability which leads to Heap Overflow.
During subpattern calculation of a malformed regular expression, an offset
that is used as an array index is fully controlled and can be large enough
so that unexpected heap memory regions are accessed.
One could at least exploit this issue to read objects nearby of the
affected application's memory.
Such information discloure may also be used to bypass memory protection
method such as ASLR.

Reference:
https://bugs.exim.org/show_bug.cgi?id=1651
"""

The patch is available in the upstream bug:

https://bugs.exim.org/show_bug.cgi?id=1651

Comment 1 Vasyl Kaigorodov 2015-06-30 14:47:54 UTC

Created pcre tracking bugs for this issue:

Affects: fedora-all [bug 1237224]

Comment 2 Vasyl Kaigorodov 2015-06-30 14:47:57 UTC

Created mingw-pcre tracking bugs for this issue:

Affects: fedora-all [bug 1237225]

Comment 3 Petr Pisar 2015-07-01 07:24:55 UTC

Upstream fixed it with:

commit 764692f9aea9eab50fdba6cb537441d8b34c6c37
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
Date:   Tue Jun 23 16:34:53 2015 +0000

    Fix buffer overflow for forward reference within backward assertion with excess
    closing parenthesis. Bugzilla 1651.
    
    
    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1571 2f5784b3-3f2a-0410-8824-cb99058d5e15

Comment 4 Fedora Update System 2015-07-13 19:13:47 UTC

pcre-8.37-2.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2015-07-18 02:05:02 UTC

pcre-8.35-12.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Tomas Hoger 2015-12-02 15:43:27 UTC

Upstream commit:

http://vcs.pcre.org/pcre?view=revision&revision=1571

Fixed upstream in version 8.38.

Comment 7 Tomas Hoger 2016-02-19 11:55:34 UTC

Introduced in pcre 8.00:

http://vcs.pcre.org/pcre?view=revision&revision=454

Comment 8 Tomas Hoger 2016-02-19 20:38:38 UTC

*** Bug 1287654 has been marked as a duplicate of this bug. ***

Comment 9 Tomas Hoger 2016-02-19 20:39:58 UTC

Adding duplicate CVE.

Comment 12 errata-xmlrpc 2016-05-11 13:07:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:1025 https://rhn.redhat.com/errata/RHSA-2016-1025.html

Comment 13 errata-xmlrpc 2016-05-26 08:38:32 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS

Via RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132

Comment 14 errata-xmlrpc 2016-11-15 11:46:52 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html