fkie_cve-2016-3191
Vulnerability from fkie_nvd
Published
2016-03-17 23:59
Modified
2025-04-12 10:46
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.
References
security@debian.orghttp://rhn.redhat.com/errata/RHSA-2016-1025.html
security@debian.orghttp://vcs.pcre.org/pcre2?view=revision&revision=489
security@debian.orghttp://vcs.pcre.org/pcre?view=revision&revision=1631
security@debian.orghttp://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
security@debian.orghttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
security@debian.orghttp://www.securityfocus.com/bid/84810
security@debian.orghttps://access.redhat.com/errata/RHSA-2016:1132
security@debian.orghttps://bto.bluecoat.com/security-advisory/sa128
security@debian.orghttps://bugs.debian.org/815920
security@debian.orghttps://bugs.debian.org/815921
security@debian.orghttps://bugs.exim.org/show_bug.cgi?id=1791Exploit
security@debian.orghttps://bugzilla.redhat.com/show_bug.cgi?id=1311503
security@debian.orghttps://www.tenable.com/security/tns-2016-18
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-1025.html
af854a3a-2127-422b-91ae-364da2661108http://vcs.pcre.org/pcre2?view=revision&revision=489
af854a3a-2127-422b-91ae-364da2661108http://vcs.pcre.org/pcre?view=revision&revision=1631
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/84810
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2016:1132
af854a3a-2127-422b-91ae-364da2661108https://bto.bluecoat.com/security-advisory/sa128
af854a3a-2127-422b-91ae-364da2661108https://bugs.debian.org/815920
af854a3a-2127-422b-91ae-364da2661108https://bugs.debian.org/815921
af854a3a-2127-422b-91ae-364da2661108https://bugs.exim.org/show_bug.cgi?id=1791Exploit
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1311503
af854a3a-2127-422b-91ae-364da2661108https://www.tenable.com/security/tns-2016-18
Impacted products
Vendor Product Version
pcre pcre 8.00
pcre pcre 8.01
pcre pcre 8.02
pcre pcre 8.10
pcre pcre 8.11
pcre pcre 8.12
pcre pcre 8.13
pcre pcre 8.20
pcre pcre 8.21
pcre pcre 8.30
pcre pcre 8.31
pcre pcre 8.32
pcre pcre 8.33
pcre pcre 8.34
pcre pcre 8.35
pcre pcre 8.36
pcre pcre 8.37
pcre pcre 8.38
pcre pcre2 *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE157F38-24DB-4B12-9964-F514A303C294",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.01:*:*:*:*:*:*:*",
              "matchCriteriaId": "D4F80172-754F-4FB1-9E84-F8EC1A6B0EEF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.02:*:*:*:*:*:*:*",
              "matchCriteriaId": "C109C2A1-BF9D-48CB-A027-82F3F3FA261B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8A8DB81-0B55-4E50-A149-C1E82BDAD0C3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2D96300-9CEF-4F64-A76F-11B1AB312579",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "61D64759-714E-47D8-B578-CCE4B59086EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "ACC08805-B9FC-4D8B-B486-813E4398DBBD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "EFD12533-1D1E-4931-B687-CBC0A17DBF3F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B2768BD-07FF-4C8C-8370-E84AE8D0707A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5C9BE45-3F45-4F46-9C15-86AA2CD3F2E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC0CD596-3719-425E-9327-8DEE38AB138B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.32:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CE5EE9A-0FA0-4851-8AF3-D884B88B2E52",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.33:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A61CB8C-6504-4602-91A5-C1595C12F6AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.34:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6876A94-2609-41CE-975E-F1ADAE1BD782",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.35:*:*:*:*:*:*:*",
              "matchCriteriaId": "9DA3CC4F-1797-46D8-8C3D-0605E71C5EAE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.36:*:*:*:*:*:*:*",
              "matchCriteriaId": "909CD13B-E836-4EBF-9433-55B4EFFE2DC4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.37:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF43E164-05C2-42A8-82CA-D1B643875C2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre:8.38:*:*:*:*:*:*:*",
              "matchCriteriaId": "9DD39B35-C14D-4044-A050-660FE4EE6AC2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4B739148-6299-4DD1-BDE5-608BDF01A44F",
              "versionEndIncluding": "10.21",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n compile_branch en pcre_compile.c en PCRE 8.x en versiones anteriores a 8.39 y pcre2_compile.c en PCRE2 en versiones anteriores a 10.22 no maneja correctamente patrones que contienen una subcadena (*ACCEPT) en conjunci\u00f3n con par\u00e9ntesis anidados, lo que permite a atacantes remotos ejecutar c\u00f3digo arbitrario o provocar una denegaci\u00f3n de servicio (desbordamiento de buffer basado en pila) a trav\u00e9s de una expresi\u00f3n regular manipuada, seg\u00fan lo demostrado por un objeto JavaScript RegExp encontrado por Konqueror, tambi\u00e9n conocido como ZDI-CAN-3542."
    }
  ],
  "id": "CVE-2016-3191",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-03-17T23:59:01.447",
  "references": [
    {
      "source": "security@debian.org",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-1025.html"
    },
    {
      "source": "security@debian.org",
      "url": "http://vcs.pcre.org/pcre2?view=revision\u0026revision=489"
    },
    {
      "source": "security@debian.org",
      "url": "http://vcs.pcre.org/pcre?view=revision\u0026revision=1631"
    },
    {
      "source": "security@debian.org",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886"
    },
    {
      "source": "security@debian.org",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
    },
    {
      "source": "security@debian.org",
      "url": "http://www.securityfocus.com/bid/84810"
    },
    {
      "source": "security@debian.org",
      "url": "https://access.redhat.com/errata/RHSA-2016:1132"
    },
    {
      "source": "security@debian.org",
      "url": "https://bto.bluecoat.com/security-advisory/sa128"
    },
    {
      "source": "security@debian.org",
      "url": "https://bugs.debian.org/815920"
    },
    {
      "source": "security@debian.org",
      "url": "https://bugs.debian.org/815921"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Exploit"
      ],
      "url": "https://bugs.exim.org/show_bug.cgi?id=1791"
    },
    {
      "source": "security@debian.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311503"
    },
    {
      "source": "security@debian.org",
      "url": "https://www.tenable.com/security/tns-2016-18"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-1025.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://vcs.pcre.org/pcre2?view=revision\u0026revision=489"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://vcs.pcre.org/pcre?view=revision\u0026revision=1631"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/84810"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2016:1132"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bto.bluecoat.com/security-advisory/sa128"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugs.debian.org/815920"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugs.debian.org/815921"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://bugs.exim.org/show_bug.cgi?id=1791"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311503"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.tenable.com/security/tns-2016-18"
    }
  ],
  "sourceIdentifier": "security@debian.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.