CVE Feed

    Dashboard / CVE / CVE-2016-3191

    CVE-2016-3191

    The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.

    Published:Feb 9, 2016
    Last Modified:Apr 12, 2025
    EPS:Mar 17, 2016
    EPSS Score:0.06286
    CVSS Score:9.8

    Affected Products

    Vendor
    Pcre
    Product
    Pcre
    Vendor
    Pcre
    Product
    Pcre2
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Software Collections

    Exploits

    https://bugs.exim.org/show_bug.cgi?id=1791https://bugs.exim.org/show_bug.cgi?id=1791

    Related CVEs

    CVE-2020-14155 (CVSS 5.3) — libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.…
    CVE-2019-20838 (CVSS 7.5) — libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has mo…
    CVE-2017-16231 (CVSS 5.5) — In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in p…
    CVE-2017-11164 (CVSS 7.5) — In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolle…
    CVE-2017-7246 (CVSS 7.8) — Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allow…
    CVE-2017-7245 (CVSS 7.8) — Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allow…
    CVE-2017-7244 (CVSS 5.5) — The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denia…
    CVE-2017-7186 (CVSS 7.5) — libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segment…
    CVE-2017-6004 (CVSS 7.5) — The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g.…
    CVE-2014-9769 (CVSS 7.3) — pcre_jit_compile.c in PCRE 8.35 does not properly use table jumps to optimize nested alternatives, which allow…

    References

    http://rhn.redhat.com/errata/RHSA-2016-1025.html
    http://vcs.pcre.org/pcre2?view=revision&revision=489
    http://vcs.pcre.org/pcre?view=revision&revision=1631
    http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
    http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
    http://www.securityfocus.com/bid/84810
    https://access.redhat.com/errata/RHSA-2016:1132
    https://bto.bluecoat.com/security-advisory/sa128
    https://bugs.debian.org/815920
    https://bugs.debian.org/815921
    https://bugs.exim.org/show_bug.cgi?id=1791
    https://bugzilla.redhat.com/show_bug.cgi?id=1311503
    https://www.tenable.com/security/tns-2016-18
    http://rhn.redhat.com/errata/RHSA-2016-1025.html
    http://vcs.pcre.org/pcre2?view=revision&revision=489
    http://vcs.pcre.org/pcre?view=revision&revision=1631
    http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
    http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
    http://www.securityfocus.com/bid/84810
    https://access.redhat.com/errata/RHSA-2016:1132
    https://bto.bluecoat.com/security-advisory/sa128
    https://bugs.debian.org/815920
    https://bugs.debian.org/815921
    https://bugs.exim.org/show_bug.cgi?id=1791
    https://bugzilla.redhat.com/show_bug.cgi?id=1311503
    https://www.tenable.com/security/tns-2016-18

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High