CVE Feed

    Dashboard / CVE / CVE-2015-3217

    CVE-2015-3217

    PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.

    Published:Jun 3, 2015
    Last Modified:Apr 12, 2025
    EPS:Dec 13, 2016
    EPSS Score:0.02892
    CVSS Score:7.5

    Affected Products

    Vendor
    Ibm
    Product
    Powerkvm
    Vendor
    Pcre
    Product
    Pcre
    Vendor
    Pcre
    Product
    Pcre2
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Software Collections

    Exploits

    https://bugs.exim.org/show_bug.cgi?id=1638https://bugs.exim.org/show_bug.cgi?id=1638

    Related CVEs

    CVE-2016-3044 (CVSS 6.5) — The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS use…
    CVE-2016-3452 (CVSS 3.7) — Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and M…
    CVE-2016-3521 (CVSS 6.5) — Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and M…
    CVE-2016-5444 (CVSS 3.7) — Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and M…
    CVE-2016-3615 (CVSS 5.3) — Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and M…
    CVE-2016-3477 (CVSS 8.1) — Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and M…
    CVE-2016-5440 (CVSS 4.9) — Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and M…
    CVE-2016-5011 (CVSS 4.6) — The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically pr…
    CVE-2016-0640 (CVSS 6.1) — Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and M…
    CVE-2016-0646 (CVSS 5.5) — Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and M…

    References

    http://rhn.redhat.com/errata/RHSA-2016-1025.html
    http://rhn.redhat.com/errata/RHSA-2016-2750.html
    http://vcs.pcre.org/pcre?view=revision&revision=1566
    http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
    http://www.openwall.com/lists/oss-security/2015/06/03/7
    http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
    http://www.securityfocus.com/bid/75018
    https://access.redhat.com/errata/RHSA-2016:1132
    https://bugs.exim.org/show_bug.cgi?id=1638
    https://bugzilla.redhat.com/show_bug.cgi?id=1228283
    http://rhn.redhat.com/errata/RHSA-2016-1025.html
    http://rhn.redhat.com/errata/RHSA-2016-2750.html
    http://vcs.pcre.org/pcre?view=revision&revision=1566
    http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
    http://www.openwall.com/lists/oss-security/2015/06/03/7
    http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
    http://www.securityfocus.com/bid/75018
    https://access.redhat.com/errata/RHSA-2016:1132
    https://bugs.exim.org/show_bug.cgi?id=1638
    https://bugzilla.redhat.com/show_bug.cgi?id=1228283

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High