Bug 1237223 (CVE-2015-5073, CVE-2015-8388) - CVE-2015-5073 CVE-2015-8388 pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis (8.38/18)
Summary: CVE-2015-5073 CVE-2015-8388 pcre: buffer overflow for forward reference withi...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-5073, CVE-2015-8388
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1287654 (view as bug list)
Depends On: 1237224 1237225 1330455 1330456 1330508 1330509
Blocks: 1287727
TreeView+ depends on / blocked
 
Reported: 2015-06-30 14:47 UTC by Vasyl Kaigorodov
Modified: 2019-09-29 13:34 UTC (History)
15 users (show)

Fixed In Version: pcre 8.38
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-15 13:29:17 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1025 0 normal SHIPPED_LIVE Important: pcre security update 2016-05-11 17:07:01 UTC
Red Hat Product Errata RHSA-2016:1132 0 normal SHIPPED_LIVE Important: rh-mariadb100-mariadb security update 2016-05-26 12:35:06 UTC
Red Hat Product Errata RHSA-2016:2750 0 normal SHIPPED_LIVE Moderate: rh-php56 security, bug fix, and enhancement update 2016-11-15 16:40:02 UTC

Description Vasyl Kaigorodov 2015-06-30 14:47:20 UTC
Quoting http://www.openwall.com/lists/oss-security/2015/06/26/1:

"""
PCRE is a regular expression C library inspired by the regular expression
capabilities in the Perl programming language.
The PCRE library is incorporated into a number of prominent programs, such
as Adobe Flash, Apache, Nginx, PHP.

PCRE library is prone to a vulnerability which leads to Heap Overflow.
During subpattern calculation of a malformed regular expression, an offset
that is used as an array index is fully controlled and can be large enough
so that unexpected heap memory regions are accessed.
One could at least exploit this issue to read objects nearby of the
affected application's memory.
Such information discloure may also be used to bypass memory protection
method such as ASLR.

Reference:
https://bugs.exim.org/show_bug.cgi?id=1651
"""

The patch is available in the upstream bug:

https://bugs.exim.org/show_bug.cgi?id=1651

Comment 1 Vasyl Kaigorodov 2015-06-30 14:47:54 UTC
Created pcre tracking bugs for this issue:

Affects: fedora-all [bug 1237224]

Comment 2 Vasyl Kaigorodov 2015-06-30 14:47:57 UTC
Created mingw-pcre tracking bugs for this issue:

Affects: fedora-all [bug 1237225]

Comment 3 Petr Pisar 2015-07-01 07:24:55 UTC
Upstream fixed it with:

commit 764692f9aea9eab50fdba6cb537441d8b34c6c37
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
Date:   Tue Jun 23 16:34:53 2015 +0000

    Fix buffer overflow for forward reference within backward assertion with excess
    closing parenthesis. Bugzilla 1651.
    
    
    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1571 2f5784b3-3f2a-0410-8824-cb99058d5e15

Comment 4 Fedora Update System 2015-07-13 19:13:47 UTC
pcre-8.37-2.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2015-07-18 02:05:02 UTC
pcre-8.35-12.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Tomas Hoger 2015-12-02 15:43:27 UTC
Upstream commit:

http://vcs.pcre.org/pcre?view=revision&revision=1571

Fixed upstream in version 8.38.

Comment 7 Tomas Hoger 2016-02-19 11:55:34 UTC
Introduced in pcre 8.00:

http://vcs.pcre.org/pcre?view=revision&revision=454

Comment 8 Tomas Hoger 2016-02-19 20:38:38 UTC
*** Bug 1287654 has been marked as a duplicate of this bug. ***

Comment 9 Tomas Hoger 2016-02-19 20:39:58 UTC
Adding duplicate CVE.

Comment 12 errata-xmlrpc 2016-05-11 13:07:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:1025 https://rhn.redhat.com/errata/RHSA-2016-1025.html

Comment 13 errata-xmlrpc 2016-05-26 08:38:32 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS

Via RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132

Comment 14 errata-xmlrpc 2016-11-15 11:46:52 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html


Note You need to log in before you can comment on or make changes to this bug.