Bug 1287623 (CVE-2015-3210, CVE-2015-8384)
| Summary: | CVE-2015-3210 CVE-2015-8384 pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | adam.stokes, andrew, carnil, erik-fedora, jgrulich, jorton, lkundrak, mclasen, mmaslano, ppisar, rcollet, rmeggins, sardella, slawomir, vkaigoro, walters, webstack-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | pcre 8.38 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-11-15 13:37:20 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1236659, 1287625, 1287626, 1287627, 1287628, 1330455, 1330456 | ||
| Bug Blocks: | 1287727 | ||
Created pcre tracking bugs for this issue: Affects: fedora-all [bug 1287625] Created glib2 tracking bugs for this issue: Affects: fedora-all [bug 1287627] Created mingw-pcre tracking bugs for this issue: Affects: fedora-all [bug 1287626] Affects: epel-7 [bug 1287628] Corresponds to item 4 in http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup Fixed in upstream with:
commit 4b79af6b4cbeb5326ae5e4d83f3e935e00286c19
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
Date: Fri May 15 17:17:03 2015 +0000
Fix buffer overflow for named recursive back reference when the name is
duplicated.
git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1558 2f5784b3-3f2a-0410-8824-
cb99058d5e15
This is duplicate of CVE-2015-3210 (bug #1226918). (In reply to Petr Pisar from comment #6) > This is duplicate of CVE-2015-3210 (bug #1226918). While both bugs link to the same patch, they are being treated as separate issue. Explanation from MITRE on this is posted on oss-sec: http://seclists.org/oss-sec/2015/q4/422 (In reply to Petr Pisar from comment #5) > commit 4b79af6b4cbeb5326ae5e4d83f3e935e00286c19 > Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15> > Date: Fri May 15 17:17:03 2015 +0000 > > Fix buffer overflow for named recursive back reference when the name is > duplicated. Upstream commit link: http://vcs.pcre.org/pcre?view=revision&revision=1558 Yet another issue introduced in upstream version 8.34, which refactored named group handling code and apparently several bugs were introduced in the process. Upstream bug report referenced by the duplicate CVE-2015-3210 (see comment 6 above): https://bugs.exim.org/show_bug.cgi?id=1636 *** Bug 1226918 has been marked as a duplicate of this bug. *** This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Via RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html |
It was discovered that PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references within group that had the same name as another group.