Bug 1287690 (CVE-2015-8392) - CVE-2015-8392 pcre: buffer overflow caused by patterns with duplicated named groups with (?| (8.38/27)
Summary: CVE-2015-8392 pcre: buffer overflow caused by patterns with duplicated named ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-8392
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1250943 (view as bug list)
Depends On: 1250946 1287691 1287692 1287693 1287694 Engineering1330455 Engineering1330456
Blocks: Embargoed1287727
TreeView+ depends on / blocked
 
Reported: 2015-12-02 14:01 UTC by Adam Mariš
Modified: 2021-09-09 11:44 UTC (History)
19 users (show)

Fixed In Version: pcre 8.38
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-15 13:41:54 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1132 0 normal SHIPPED_LIVE Important: rh-mariadb100-mariadb security update 2016-05-26 12:35:06 UTC
Red Hat Product Errata RHSA-2016:2750 0 normal SHIPPED_LIVE Moderate: rh-php56 security, bug fix, and enhancement update 2016-11-15 16:40:02 UTC

Description Adam Mariš 2015-12-02 14:01:32 UTC 
A buffer overflow vulnerability in PCRE before 8.38 was found, caused by pattern with duplicated named groups and an occurrence of (?| , it is possible for an apparently non-recursive back reference to become recursive if a later named group with the relevant number is encountered. This allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
Comment 1 Adam Mariš 2015-12-02 14:03:00 UTC 
Created pcre tracking bugs for this issue:

Affects: fedora-all [bug 1287691]
Comment 2 Adam Mariš 2015-12-02 14:03:09 UTC 
Created glib2 tracking bugs for this issue:

Affects: fedora-all [bug 1287693]
Comment 3 Adam Mariš 2015-12-02 14:03:18 UTC 
Created mingw-pcre tracking bugs for this issue:

Affects: fedora-all [bug 1287692]
Affects: epel-7 [bug 1287694]
Comment 4 Adam Mariš 2015-12-02 15:24:30 UTC 
Corresponds to item 27 in http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
Comment 5 Petr Pisar 2015-12-02 16:09:37 UTC 
Fixed in upstream with:

commit 7af8e8717def179fd7b69e173abd347c1a3547cb
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
Date:   Wed Aug 5 15:38:32 2015 +0000

    Fix buffer overflow for named references in (?| situations.
    
    
    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1585 2f5784b3-3f2a-0410-8824-
cb99058d5e15
Comment 6 Tomas Hoger 2016-02-19 21:04:38 UTC 
(In reply to Petr Pisar from comment #5)
> commit 7af8e8717def179fd7b69e173abd347c1a3547cb
> Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
> Date:   Wed Aug 5 15:38:32 2015 +0000
> 
> Fix buffer overflow for named references in (?| situations.

Upstream commit link:

http://vcs.pcre.org/pcre?view=revision&revision=1585
Comment 7 Tomas Hoger 2016-02-19 21:20:41 UTC 
Another issue introduced in upstream version 8.34, which refactored named group handling code and apparently several bugs were introduced in the process.
Comment 8 Tomas Hoger 2016-02-22 12:44:21 UTC 
*** Bug 1250943 has been marked as a duplicate of this bug. ***
Comment 9 Tomas Hoger 2016-02-22 12:45:50 UTC 
Upstream bug (see duplicate bug 1250943):

https://bugs.exim.org/show_bug.cgi?id=1667
Comment 11 errata-xmlrpc 2016-05-26 08:42:31 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS

Via RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132
Comment 12 errata-xmlrpc 2016-11-15 11:48:42 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html
Note You need to log in before you can comment on or make changes to this bug.