Bug 1287623 (CVE-2015-3210, CVE-2015-8384) - CVE-2015-3210 CVE-2015-8384 pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4)
Summary: CVE-2015-3210 CVE-2015-8384 pcre: buffer overflow caused by recursive back re...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-3210, CVE-2015-8384
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1226918 (view as bug list)
Depends On: 1236659 1287625 1287626 1287627 1287628 1330455 1330456
Blocks: 1287727
TreeView+ depends on / blocked
 
Reported: 2015-12-02 13:11 UTC by Adam Mariš
Modified: 2019-09-29 13:40 UTC (History)
17 users (show)

Fixed In Version: pcre 8.38
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-15 13:37:20 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1132 0 normal SHIPPED_LIVE Important: rh-mariadb100-mariadb security update 2016-05-26 12:35:06 UTC
Red Hat Product Errata RHSA-2016:2750 0 normal SHIPPED_LIVE Moderate: rh-php56 security, bug fix, and enhancement update 2016-11-15 16:40:02 UTC

Description Adam Mariš 2015-12-02 13:11:24 UTC
It was discovered that PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references within group that had the same name as another group.

Comment 1 Adam Mariš 2015-12-02 13:13:17 UTC
Created pcre tracking bugs for this issue:

Affects: fedora-all [bug 1287625]

Comment 2 Adam Mariš 2015-12-02 13:13:27 UTC
Created glib2 tracking bugs for this issue:

Affects: fedora-all [bug 1287627]

Comment 3 Adam Mariš 2015-12-02 13:13:34 UTC
Created mingw-pcre tracking bugs for this issue:

Affects: fedora-all [bug 1287626]
Affects: epel-7 [bug 1287628]

Comment 4 Adam Mariš 2015-12-02 15:22:56 UTC
Corresponds to item 4 in http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup

Comment 5 Petr Pisar 2015-12-02 15:44:51 UTC
Fixed in upstream with:

commit 4b79af6b4cbeb5326ae5e4d83f3e935e00286c19
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
Date:   Fri May 15 17:17:03 2015 +0000

    Fix buffer overflow for named recursive back reference when the name is
    duplicated.
    
    
    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1558 2f5784b3-3f2a-0410-8824-
cb99058d5e15

Comment 6 Petr Pisar 2015-12-02 16:38:11 UTC
This is duplicate of CVE-2015-3210 (bug #1226918).

Comment 7 Martin Prpič 2015-12-03 11:56:22 UTC
(In reply to Petr Pisar from comment #6)
> This is duplicate of CVE-2015-3210 (bug #1226918).

While both bugs link to the same patch, they are being treated as separate issue. Explanation from MITRE on this is posted on oss-sec:

http://seclists.org/oss-sec/2015/q4/422

Comment 8 Tomas Hoger 2016-02-18 17:27:40 UTC
(In reply to Petr Pisar from comment #5)
> commit 4b79af6b4cbeb5326ae5e4d83f3e935e00286c19
> Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
> Date:   Fri May 15 17:17:03 2015 +0000
> 
> Fix buffer overflow for named recursive back reference when the name is
> duplicated.

Upstream commit link:

http://vcs.pcre.org/pcre?view=revision&revision=1558

Comment 9 Tomas Hoger 2016-02-18 17:30:33 UTC
Yet another issue introduced in upstream version 8.34, which refactored named group handling code and apparently several bugs were introduced in the process.

Comment 10 Tomas Hoger 2016-02-18 17:34:24 UTC
Upstream bug report referenced by the duplicate CVE-2015-3210 (see comment 6 above):

https://bugs.exim.org/show_bug.cgi?id=1636

Comment 11 Tomas Hoger 2016-02-23 09:30:47 UTC
*** Bug 1226918 has been marked as a duplicate of this bug. ***

Comment 13 errata-xmlrpc 2016-05-26 08:41:43 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS

Via RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132

Comment 14 errata-xmlrpc 2016-11-15 11:47:52 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html


Note You need to log in before you can comment on or make changes to this bug.