CVE-2015-2326

MEDIUM EPSS 72.7%
Published Jan 14, 20206y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jan 14, 2020 6y ago
Last Modified Jun 17, 2026 2w ago

Description

The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
72.7% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 7

VendorProductVersionRange
pcrepcre* <8.37
opensuseopensuse13.1any
opensuseopensuse13.2any
mariadbmariadb*≥10.0.0  –  <10.0.18
phpphp*≥5.4.0  –  <5.4.41
phpphp*≥5.5.0  –  <5.5.26
phpphp*≥5.6.0  –  <5.6.9

References 4

  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html
    Mailing ListThird Party Advisory
  • bugs.exim.org https://bugs.exim.org/show_bug.cgi?id=1592
    ExploitIssue TrackingPermissions RequiredThird Party Advisory
  • fortiguard.com https://fortiguard.com/zeroday/FG-VD-15-016
    Third Party Advisory
  • pcre.org https://www.pcre.org/original/changelog.txt
    Release NotesThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.