CVE Feed

    Dashboard / CVE / CVE-2015-2328

    CVE-2015-2328

    PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

    Published:Aug 7, 2014
    Last Modified:Apr 12, 2025
    EPS:Dec 2, 2015
    EPSS Score:0.04338
    CVSS Score:7.5

    Affected Products

    Vendor
    Oracle
    Product
    Linux
    Vendor
    Pcre
    Product
    Pcre
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Software Collections

    Exploits

    http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markuphttps://bugs.exim.org/show_bug.cgi?id=1515http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markuphttps://bugs.exim.org/show_bug.cgi?id=1515

    Common Weakness Enumeration

    CWE-674 Uncontrolled Recursion

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-230 Serialized Data with Nested Payloads
    CAPEC-231 Oversized Serialized Data Payloads

    Related CVEs

    CVE-2026-35233 (CVSS 4.4) — An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range…
    CVE-2026-21996 (CVSS 3.3) — An unprivileged attacker can reliably trigger a crash of the dtrace process with a malicious ELF binary due to…
    CVE-2026-21991 (CVSS 5.5) — A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.…
    CVE-2025-4598 (CVSS 4.7) — A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash a…
    CVE-2023-22024 (CVSS 5.5) — In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options, RDS_CONN_RESE…
    CVE-2022-21385 (CVSS 6.2) — A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine. CV…
    CVE-2022-21505 (CVSS 6.7) — In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated…
    CVE-2022-21504 (CVSS 5.5) — The code in UEK6 U3 was missing an appropiate file descriptor count to be missing. This resulted in a use coun…
    CVE-2022-21499 (CVSS 6.7) — KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An a…
    CVE-2021-2464 (CVSS 7.8) — Vulnerability in Oracle Linux (component: OSwatcher). Supported versions that are affected are 7 and 8. Easily…

    References

    http://rhn.redhat.com/errata/RHSA-2016-1025.html
    http://rhn.redhat.com/errata/RHSA-2016-2750.html
    http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
    http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
    http://www.fortiguard.com/advisory/FG-VD-15-014/
    http://www.openwall.com/lists/oss-security/2015/11/29/1
    http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
    http://www.securityfocus.com/bid/74924
    https://bugs.exim.org/show_bug.cgi?id=1515
    https://jira.mongodb.org/browse/SERVER-17252
    http://rhn.redhat.com/errata/RHSA-2016-1025.html
    http://rhn.redhat.com/errata/RHSA-2016-2750.html
    http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
    http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
    http://www.fortiguard.com/advisory/FG-VD-15-014/
    http://www.openwall.com/lists/oss-security/2015/11/29/1
    http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
    http://www.securityfocus.com/bid/74924
    https://bugs.exim.org/show_bug.cgi?id=1515
    https://jira.mongodb.org/browse/SERVER-17252

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High