CVE Feed

    Dashboard / CVE / CVE-2015-8385

    CVE-2015-8385

    PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

    Published:Nov 23, 2015
    Last Modified:Apr 12, 2025
    EPS:Dec 2, 2015
    EPSS Score:0.09142
    CVSS Score:7.5

    Affected Products

    Vendor
    Oracle
    Product
    Linux
    Vendor
    Pcre
    Product
    Perl Compatible Regular Expression Library
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Software Collections

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-35233 (CVSS 4.4) — An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range…
    CVE-2026-21996 (CVSS 3.3) — An unprivileged attacker can reliably trigger a crash of the dtrace process with a malicious ELF binary due to…
    CVE-2026-21991 (CVSS 5.5) — A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.…
    CVE-2025-4598 (CVSS 4.7) — A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash a…
    CVE-2023-22024 (CVSS 5.5) — In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options, RDS_CONN_RESE…
    CVE-2022-21385 (CVSS 6.2) — A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine. CV…
    CVE-2022-21505 (CVSS 6.7) — In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated…
    CVE-2022-21504 (CVSS 5.5) — The code in UEK6 U3 was missing an appropiate file descriptor count to be missing. This resulted in a use coun…
    CVE-2022-21499 (CVSS 6.7) — KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An a…
    CVE-2021-2464 (CVSS 7.8) — Vulnerability in Oracle Linux (component: OSwatcher). Supported versions that are affected are 7 and 8. Easily…

    References

    http://rhn.redhat.com/errata/RHSA-2016-1025.html
    http://rhn.redhat.com/errata/RHSA-2016-2750.html
    http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
    http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
    http://www.openwall.com/lists/oss-security/2015/11/29/1
    http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
    http://www.securityfocus.com/bid/85572
    https://access.redhat.com/errata/RHSA-2016:1132
    https://bto.bluecoat.com/security-advisory/sa128
    https://security.gentoo.org/glsa/201607-02
    http://rhn.redhat.com/errata/RHSA-2016-1025.html
    http://rhn.redhat.com/errata/RHSA-2016-2750.html
    http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
    http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
    http://www.openwall.com/lists/oss-security/2015/11/29/1
    http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
    http://www.securityfocus.com/bid/85572
    https://access.redhat.com/errata/RHSA-2016:1132
    https://bto.bluecoat.com/security-advisory/sa128
    https://security.gentoo.org/glsa/201607-02

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High