NetSight
IP …
medium6.8

CVE-2015-2305

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD throug…

Impact

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.

Affected products

VendorProductAffected versions
Rxspencer ProjectRxspencer
Version 3.8.g5
CanonicalUbuntu Linux
Versions 10.04, 12.04, 14.04, 14.10, 15.04
DebianDebian Linux
Versions 7.0, 8.0
OpensuseOpensuse
Versions 13.1, 13.2
PhpPhp
from 5.4.0 before 5.4.39
from 5.5.0 before 5.5.23
from 5.6.0 before 5.6.7

Weakness classification

CWE-190

References