#VU87885 Buffer overflow in PCRE - CVE-2015-8385

Vulnerability identifier: #VU87885

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2015-8385

CWE-ID: CWE-119

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
PCRE
Universal components / Libraries / Libraries used by multiple products

Vendor: PCRE

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to PCRE mishandles the /(?|(k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references. A remote attacker can create a specially crafted Office document, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

PCRE: before 8.38

---

External links
https://rhn.redhat.com/errata/RHSA-2016-1025.html
https://rhn.redhat.com/errata/RHSA-2016-2750.html
https://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
https://www.openwall.com/lists/oss-security/2015/11/29/1
https://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
https://www.securityfocus.com/bid/85572
https://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
https://access.redhat.com/errata/RHSA-2016:1132
https://bto.bluecoat.com/security-advisory/sa128
https://security.gentoo.org/glsa/201607-02

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.