The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
| CVE | CVE-2016-1283 |
|---|---|
| Severidad | CRITICAL |
| CVSS | 9.8 / 10 |
| EPSS | 7.8% en 30 días (percentil 94) |
| CWE | CWE-119 |
| Exposición (Shodan) | 113.365 host(s) expuesto(s) en internet ahora mismo |
Productos afectados (catálogo NVD)
fedoraproject/fedoraoracle/solarispcre/pcrephp/php