Bug 1237223 – CVE-2015-5073 CVE-2015-8388 pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis (8.38/18)

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1237223 - (CVE-2015-5073, CVE-2015-8388) CVE-2015-5073 CVE-2015-8388 pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis (8.38/18)

Summary:	CVE-2015-5073 CVE-2015-8388 pcre: buffer overflow for forward reference withi...

Status:	CLOSED ERRATA

Aliases:	CVE-2015-5073, CVE-2015-8388

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20150623,repor...
Keywords:	Security

Duplicates:	1287654 (view as bug list)
Depends On:	1237224 1237225 1330455 1330456 1330508 1330509
Blocks:	1287727
	Show dependency tree / graph

Reported:	2015-06-30 10:47 EDT by Vasyl Kaigorodov
Modified:	2016-11-15 08:29 EST (History)
CC List:	15 users (show)

See Also:
Fixed In Version:	pcre 8.38
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-11-15 08:29:17 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2016:1025	normal	SHIPPED_LIVE	Important: pcre security update	2016-05-11 13:07:01 EDT
Red Hat Product Errata	RHSA-2016:1132	normal	SHIPPED_LIVE	Important: rh-mariadb100-mariadb security update	2016-05-26 08:35:06 EDT
Red Hat Product Errata	RHSA-2016:2750	normal	SHIPPED_LIVE	Moderate: rh-php56 security, bug fix, and enhancement update	2016-11-15 11:40:02 EST

Groups: None (edit)

Description Vasyl Kaigorodov 2015-06-30 10:47:20 EDT

Quoting http://www.openwall.com/lists/oss-security/2015/06/26/1:

"""
PCRE is a regular expression C library inspired by the regular expression
capabilities in the Perl programming language.
The PCRE library is incorporated into a number of prominent programs, such
as Adobe Flash, Apache, Nginx, PHP.

PCRE library is prone to a vulnerability which leads to Heap Overflow.
During subpattern calculation of a malformed regular expression, an offset
that is used as an array index is fully controlled and can be large enough
so that unexpected heap memory regions are accessed.
One could at least exploit this issue to read objects nearby of the
affected application's memory.
Such information discloure may also be used to bypass memory protection
method such as ASLR.

Reference:
https://bugs.exim.org/show_bug.cgi?id=1651
"""

The patch is available in the upstream bug:

https://bugs.exim.org/show_bug.cgi?id=1651

Comment 1 Vasyl Kaigorodov 2015-06-30 10:47:54 EDT

Created pcre tracking bugs for this issue:

Affects: fedora-all [bug 1237224]

Comment 2 Vasyl Kaigorodov 2015-06-30 10:47:57 EDT

Created mingw-pcre tracking bugs for this issue:

Affects: fedora-all [bug 1237225]

Comment 3 Petr Pisar 2015-07-01 03:24:55 EDT

Upstream fixed it with:

commit 764692f9aea9eab50fdba6cb537441d8b34c6c37
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
Date:   Tue Jun 23 16:34:53 2015 +0000

    Fix buffer overflow for forward reference within backward assertion with excess
    closing parenthesis. Bugzilla 1651.
    
    
    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1571 2f5784b3-3f2a-0410-8824-cb99058d5e15

Comment 4 Fedora Update System 2015-07-13 15:13:47 EDT

pcre-8.37-2.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2015-07-17 22:05:02 EDT

pcre-8.35-12.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Tomas Hoger 2015-12-02 10:43:27 EST

Upstream commit:

http://vcs.pcre.org/pcre?view=revision&revision=1571

Fixed upstream in version 8.38.

Comment 7 Tomas Hoger 2016-02-19 06:55:34 EST

Introduced in pcre 8.00:

http://vcs.pcre.org/pcre?view=revision&revision=454

Comment 8 Tomas Hoger 2016-02-19 15:38:38 EST

*** Bug 1287654 has been marked as a duplicate of this bug. ***

Comment 9 Tomas Hoger 2016-02-19 15:39:58 EST

Adding duplicate CVE.

Comment 12 errata-xmlrpc 2016-05-11 09:07:23 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:1025 https://rhn.redhat.com/errata/RHSA-2016-1025.html

Comment 13 errata-xmlrpc 2016-05-26 04:38:32 EDT

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS

Via RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132

Comment 14 errata-xmlrpc 2016-11-15 06:46:52 EST

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html

Note You need to log in before you can comment on or make changes to this bug.