Bug 1287690 - (CVE-2015-8392) CVE-2015-8392 pcre: buffer overflow caused by patterns with duplicated named groups with (?| (8.38/27)
CVE-2015-8392 pcre: buffer overflow caused by patterns with duplicated named ...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20151123,repo...
: Security
: 1250943 (view as bug list)
Depends On: 1250946 1287691 1287692 1287693 1287694 1330455 1330456
Blocks: 1287727
  Show dependency treegraph
 
Reported: 2015-12-02 09:01 EST by Adam Mariš
Modified: 2016-11-15 08:41 EST (History)
18 users (show)

See Also:
Fixed In Version: pcre 8.38
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-11-15 08:41:54 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Adam Mariš 2015-12-02 09:01:32 EST
A buffer overflow vulnerability in PCRE before 8.38 was found, caused by pattern with duplicated named groups and an occurrence of (?| , it is possible for an apparently non-recursive back reference to become recursive if a later named group with the relevant number is encountered. This allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
Comment 1 Adam Mariš 2015-12-02 09:03:00 EST
Created pcre tracking bugs for this issue:

Affects: fedora-all [bug 1287691]
Comment 2 Adam Mariš 2015-12-02 09:03:09 EST
Created glib2 tracking bugs for this issue:

Affects: fedora-all [bug 1287693]
Comment 3 Adam Mariš 2015-12-02 09:03:18 EST
Created mingw-pcre tracking bugs for this issue:

Affects: fedora-all [bug 1287692]
Affects: epel-7 [bug 1287694]
Comment 4 Adam Mariš 2015-12-02 10:24:30 EST
Corresponds to item 27 in http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
Comment 5 Petr Pisar 2015-12-02 11:09:37 EST
Fixed in upstream with:

commit 7af8e8717def179fd7b69e173abd347c1a3547cb
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
Date:   Wed Aug 5 15:38:32 2015 +0000

    Fix buffer overflow for named references in (?| situations.
    
    
    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1585 2f5784b3-3f2a-0410-8824-
cb99058d5e15
Comment 6 Tomas Hoger 2016-02-19 16:04:38 EST
(In reply to Petr Pisar from comment #5)
> commit 7af8e8717def179fd7b69e173abd347c1a3547cb
> Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
> Date:   Wed Aug 5 15:38:32 2015 +0000
> 
> Fix buffer overflow for named references in (?| situations.

Upstream commit link:

http://vcs.pcre.org/pcre?view=revision&revision=1585
Comment 7 Tomas Hoger 2016-02-19 16:20:41 EST
Another issue introduced in upstream version 8.34, which refactored named group handling code and apparently several bugs were introduced in the process.
Comment 8 Tomas Hoger 2016-02-22 07:44:21 EST
*** Bug 1250943 has been marked as a duplicate of this bug. ***
Comment 9 Tomas Hoger 2016-02-22 07:45:50 EST
Upstream bug (see duplicate bug 1250943):

https://bugs.exim.org/show_bug.cgi?id=1667
Comment 11 errata-xmlrpc 2016-05-26 04:42:31 EDT
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS

Via RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132
Comment 12 errata-xmlrpc 2016-11-15 06:48:42 EST
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html

Note You need to log in before you can comment on or make changes to this bug.