The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.
Platform | Package | Release Date | Advisory |
---|---|---|---|
Amazon Linux 1 | php54 | 2015-06-02 22:20 | ALAS-2015-534 |
Amazon Linux 1 | php55 | 2015-07-07 12:40 | ALAS-2015-562 |
Amazon Linux 1 | php56 | 2015-07-07 12:40 | ALAS-2015-563 |
Amazon Linux 1 | php56 | 2015-06-02 22:22 | ALAS-2015-536 |
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv2 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
NVD | CVSSv2 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
NVD | CVSSv3 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |