NetSight
IP …
high7.5

CVE-2015-3217

PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buf…

Impact

PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.

Affected products

VendorProductAffected versions
PcrePcre2
Version 10.10
PcrePcre
Versions 7.8, 8.32, 8.33, 8.34, 8.35, 8.36
IbmPowerkvm
Versions 2.1, 3.1

Weakness classification

CWE-119

References