CVE-2015-8388

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-119 CWE-185

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2016-1025.html
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markupRelease Notes, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/11/29/1Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlThird Party Advisory
http://www.securityfocus.com/bid/85576Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2016:1132
https://bto.bluecoat.com/security-advisory/sa128Third Party Advisory
https://security.gentoo.org/glsa/201607-02
http://rhn.redhat.com/errata/RHSA-2016-1025.html
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markupRelease Notes, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/11/29/1Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlThird Party Advisory
http://www.securityfocus.com/bid/85576Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2016:1132
https://bto.bluecoat.com/security-advisory/sa128Third Party Advisory
https://security.gentoo.org/glsa/201607-02

Timeline

Published: Dec 2, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-83899.8PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (in CVE-2015-83909.8PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (unini CVE-2015-83919.8The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a deni CVE-2015-83927.5PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended r CVE-2015-83937.5pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information v CVE-2015-83949.8PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integ CVE-2015-83957.5PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified othe CVE-2015-839610.0Integer overflow in the ImageRegionReader::ReadIntoBuffer function in MediaStorageAndFileFormat/gdcmImageRegionReader.cxx in Grassroots DICO CVE-2015-83978.2The JPEGLSCodec::DecodeExtent function in MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows r CVE-2015-83986.1Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTM CVE-2015-83994.3Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spac CVE-2015-84007.4The HTTPS fallback implementation in Shell In A Box (aka shellinabox) before 2.19 makes it easier for remote attackers to conduct DNS rebind