CVE-2015-2326: Medium severity pcre vulnerability
The pcrecompile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2015-2326.
What is the severity of CVE-2015-2326?
The severity of CVE-2015-2326 is medium.
Which software versions are affected by CVE-2015-2326?
PCRE before version 8.37, Opensuse 13.1 and 13.2, MariaDB version 10.0.0 to 10.0.18, PHP version 5.4.0 to 5.4.41, PHP version 5.5.0 to 5.5.26, and PHP version 5.6.0 to 5.6.9 are affected by CVE-2015-2326.
How can an attacker exploit CVE-2015-2326?
An attacker can exploit CVE-2015-2326 by using a regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, causing a denial of service (out-of-bounds read).
Is there a fix available for CVE-2015-2326?
Yes, updating to PCRE version 8.37 or later, Opensuse 13.1 or 13.2, MariaDB version 10.0.18 or later, or PHP version 5.4.41 or later, 5.5.26 or later, or 5.6.9 or later will fix CVE-2015-2326.