CVE-2015-2325

HIGH EPSS 72.4%

Published Jan 14, 20206y ago · Modified Jun 17, 20262w ago

7.8 CVSS 3.1

High

Published Jan 14, 2020 6y ago

Last Modified Jun 17, 2026 2w ago

Description

The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.

CVSS Details

Base Score

7.8

Exploitability

1.8

Impact

5.9

Vector string

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

72.4% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 2

CWE-125 Out-of-bounds Read Memory Safety

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 7

Vendor	Product	Version	Range
pcre	pcre	*	<8.37
opensuse	opensuse	13.1	any
opensuse	opensuse	13.2	any
mariadb	mariadb	*	<10.0.18
php	php	*	≥5.4.0 – <5.4.41
php	php	*	≥5.5.0 – <5.5.26
php	php	*	≥5.6.0 – <5.6.9

References 4

lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html

Mailing ListThird Party Advisory
bugs.exim.org https://bugs.exim.org/show_bug.cgi?id=1591

ExploitIssue TrackingPermissions RequiredThird Party Advisory
fortiguard.com https://fortiguard.com/zeroday/FG-VD-15-015

Third Party Advisory
pcre.org https://www.pcre.org/original/changelog.txt

Release NotesVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.