cve/2015/CVE-2015-3217.md

CVE-2015-3217

Description

PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\.|([^\\W_])?)+)+$/.

POC

Reference

• http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1228283

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/RedHatSatellite/satellite-host-cve