The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".
Platform | Package | Release Date | Advisory |
---|---|---|---|
Amazon Linux 1 | php54 | 2015-06-02 22:20 | ALAS-2015-534 |
Amazon Linux 1 | php55 | 2015-07-07 12:40 | ALAS-2015-562 |
Amazon Linux 1 | php56 | 2015-07-07 12:40 | ALAS-2015-563 |
Amazon Linux 1 | php56 | 2015-06-02 22:22 | ALAS-2015-536 |
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv2 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
NVD | CVSSv3 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
NVD | CVSSv2 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |