Bug 1287690 (CVE-2015-8392) - CVE-2015-8392 pcre: buffer overflow caused by patterns with duplicated named groups with (?| (8.38/27)
Summary: CVE-2015-8392 pcre: buffer overflow caused by patterns with duplicated named ...
Status: CLOSED ERRATA
Alias: CVE-2015-8392
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20151123,repo...
Keywords: Security
: 1250943 (view as bug list)
Depends On: 1250946 1287691 1287692 1287693 1287694 1330455 1330456
Blocks: 1287727
TreeView+ depends on / blocked
 
Reported: 2015-12-02 14:01 UTC by Adam Mariš
Modified: 2019-06-08 20:52 UTC (History)
19 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2016-11-15 13:41:54 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1132 normal SHIPPED_LIVE Important: rh-mariadb100-mariadb security update 2016-05-26 12:35:06 UTC
Red Hat Product Errata RHSA-2016:2750 normal SHIPPED_LIVE Moderate: rh-php56 security, bug fix, and enhancement update 2016-11-15 16:40:02 UTC

Description Adam Mariš 2015-12-02 14:01:32 UTC
A buffer overflow vulnerability in PCRE before 8.38 was found, caused by pattern with duplicated named groups and an occurrence of (?| , it is possible for an apparently non-recursive back reference to become recursive if a later named group with the relevant number is encountered. This allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression.

Comment 1 Adam Mariš 2015-12-02 14:03:00 UTC
Created pcre tracking bugs for this issue:

Affects: fedora-all [bug 1287691]

Comment 2 Adam Mariš 2015-12-02 14:03:09 UTC
Created glib2 tracking bugs for this issue:

Affects: fedora-all [bug 1287693]

Comment 3 Adam Mariš 2015-12-02 14:03:18 UTC
Created mingw-pcre tracking bugs for this issue:

Affects: fedora-all [bug 1287692]
Affects: epel-7 [bug 1287694]

Comment 4 Adam Mariš 2015-12-02 15:24:30 UTC
Corresponds to item 27 in http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup

Comment 5 Petr Pisar 2015-12-02 16:09:37 UTC
Fixed in upstream with:

commit 7af8e8717def179fd7b69e173abd347c1a3547cb
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
Date:   Wed Aug 5 15:38:32 2015 +0000

    Fix buffer overflow for named references in (?| situations.
    
    
    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1585 2f5784b3-3f2a-0410-8824-
cb99058d5e15

Comment 6 Tomas Hoger 2016-02-19 21:04:38 UTC
(In reply to Petr Pisar from comment #5)
> commit 7af8e8717def179fd7b69e173abd347c1a3547cb
> Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
> Date:   Wed Aug 5 15:38:32 2015 +0000
> 
> Fix buffer overflow for named references in (?| situations.

Upstream commit link:

http://vcs.pcre.org/pcre?view=revision&revision=1585

Comment 7 Tomas Hoger 2016-02-19 21:20:41 UTC
Another issue introduced in upstream version 8.34, which refactored named group handling code and apparently several bugs were introduced in the process.

Comment 8 Tomas Hoger 2016-02-22 12:44:21 UTC
*** Bug 1250943 has been marked as a duplicate of this bug. ***

Comment 9 Tomas Hoger 2016-02-22 12:45:50 UTC
Upstream bug (see duplicate bug 1250943):

https://bugs.exim.org/show_bug.cgi?id=1667

Comment 11 errata-xmlrpc 2016-05-26 08:42:31 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS

Via RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132

Comment 12 errata-xmlrpc 2016-11-15 11:48:42 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html


Note You need to log in before you can comment on or make changes to this bug.