CVE-2015-5073

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-119 CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2016-1025.html
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://vcs.pcre.org/pcre/code/trunk/ChangeLog?revision=1609&view=markupVendor Advisory
http://vcs.pcre.org/pcre?view=revision&revision=1571Exploit, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/06/26/1Mailing List
http://www.openwall.com/lists/oss-security/2015/06/26/3Mailing List
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
http://www.securityfocus.com/bid/75430Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1033154Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2016:1132
https://bugs.exim.org/show_bug.cgi?id=1651Exploit
https://security.gentoo.org/glsa/201607-02
http://rhn.redhat.com/errata/RHSA-2016-1025.html
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://vcs.pcre.org/pcre/code/trunk/ChangeLog?revision=1609&view=markupVendor Advisory
http://vcs.pcre.org/pcre?view=revision&revision=1571Exploit, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/06/26/1Mailing List
http://www.openwall.com/lists/oss-security/2015/06/26/3Mailing List
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
http://www.securityfocus.com/bid/75430Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1033154Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2016:1132
https://bugs.exim.org/show_bug.cgi?id=1651Exploit
https://security.gentoo.org/glsa/201607-02

Timeline

Published: Dec 13, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-50747.5Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM be CVE-2015-50756.8Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of adminis CVE-2015-50764.3Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or CVE-2015-50786.5SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenti CVE-2015-50797.5Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a .. CVE-2015-50809.0The Management Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before 10.1.132.8, 10.5 before CVE-2015-50818.8Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privil CVE-2015-508210.0Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) N CVE-2015-50842.1The Siemens SIMATIC WinCC Sm@rtClient and Sm@rtClient Lite applications before 01.00.01.00 for Android do not properly store passwords, whic CVE-2015-50856.8Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrob CVE-2015-50866.8Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrob CVE-2015-508710.0Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrob