Heap-based Buffer Overflow in PCRE Affects Multiple Vendors
CVE-2016-1283
9.8CRITICAL
What is CVE-2016-1283?
The function pcre_compile2 in PCRE 8.38 is susceptible to a vulnerability that improperly handles complex patterns with named subgroups. This flaw can be exploited by remote attackers, leading to a heap-based buffer overflow, which potentially allows for a denial of service attack. Crafting specific regular expressions can trigger this vulnerability, as demonstrated by its impact on various applications, including a JavaScript RegExp object encountered by the Konqueror web browser.
References
EPSS Score
7% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved