Bug 1287623 - (CVE-2015-3210, CVE-2015-8384) CVE-2015-3210 CVE-2015-8384 pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4)
CVE-2015-3210 CVE-2015-8384 pcre: buffer overflow caused by recursive back re...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20151123,repo...
: Security
: 1226918 (view as bug list)
Depends On: 1236659 1287625 1287626 1287627 1287628 1330455 1330456
Blocks: 1287727
  Show dependency treegraph
 
Reported: 2015-12-02 08:11 EST by Adam Mariš
Modified: 2016-11-15 08:37 EST (History)
17 users (show)

See Also:
Fixed In Version: pcre 8.38
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-11-15 08:37:20 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Adam Mariš 2015-12-02 08:11:24 EST
It was discovered that PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references within group that had the same name as another group.
Comment 1 Adam Mariš 2015-12-02 08:13:17 EST
Created pcre tracking bugs for this issue:

Affects: fedora-all [bug 1287625]
Comment 2 Adam Mariš 2015-12-02 08:13:27 EST
Created glib2 tracking bugs for this issue:

Affects: fedora-all [bug 1287627]
Comment 3 Adam Mariš 2015-12-02 08:13:34 EST
Created mingw-pcre tracking bugs for this issue:

Affects: fedora-all [bug 1287626]
Affects: epel-7 [bug 1287628]
Comment 4 Adam Mariš 2015-12-02 10:22:56 EST
Corresponds to item 4 in http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
Comment 5 Petr Pisar 2015-12-02 10:44:51 EST
Fixed in upstream with:

commit 4b79af6b4cbeb5326ae5e4d83f3e935e00286c19
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
Date:   Fri May 15 17:17:03 2015 +0000

    Fix buffer overflow for named recursive back reference when the name is
    duplicated.
    
    
    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1558 2f5784b3-3f2a-0410-8824-
cb99058d5e15
Comment 6 Petr Pisar 2015-12-02 11:38:11 EST
This is duplicate of CVE-2015-3210 (bug #1226918).
Comment 7 Martin Prpič 2015-12-03 06:56:22 EST
(In reply to Petr Pisar from comment #6)
> This is duplicate of CVE-2015-3210 (bug #1226918).

While both bugs link to the same patch, they are being treated as separate issue. Explanation from MITRE on this is posted on oss-sec:

http://seclists.org/oss-sec/2015/q4/422
Comment 8 Tomas Hoger 2016-02-18 12:27:40 EST
(In reply to Petr Pisar from comment #5)
> commit 4b79af6b4cbeb5326ae5e4d83f3e935e00286c19
> Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
> Date:   Fri May 15 17:17:03 2015 +0000
> 
> Fix buffer overflow for named recursive back reference when the name is
> duplicated.

Upstream commit link:

http://vcs.pcre.org/pcre?view=revision&revision=1558
Comment 9 Tomas Hoger 2016-02-18 12:30:33 EST
Yet another issue introduced in upstream version 8.34, which refactored named group handling code and apparently several bugs were introduced in the process.
Comment 10 Tomas Hoger 2016-02-18 12:34:24 EST
Upstream bug report referenced by the duplicate CVE-2015-3210 (see comment 6 above):

https://bugs.exim.org/show_bug.cgi?id=1636
Comment 11 Tomas Hoger 2016-02-23 04:30:47 EST
*** Bug 1226918 has been marked as a duplicate of this bug. ***
Comment 13 errata-xmlrpc 2016-05-26 04:41:43 EDT
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS

Via RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132
Comment 14 errata-xmlrpc 2016-11-15 06:47:52 EST
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html

Note You need to log in before you can comment on or make changes to this bug.