2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2015-2305" ,
"sourceIdentifier" : "cve@mitre.org" ,
"published" : "2015-03-30T10:59:11.663" ,
2024-11-22 23:14:22 +00:00
"lastModified" : "2024-11-21T02:27:10.973" ,
"vulnStatus" : "Modified" ,
2024-12-08 03:06:42 +00:00
"cveTags" : [ ] ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow."
} ,
{
"lang" : "es" ,
"value" : "Desbordamiento de enteros en la implementaci\u00f3n regcomp en la librer\u00eda Henry Spencer BSD regex (tambi\u00e9n conocido como rxspencer) alpha3.8.g5 en las plataformas de 32 bits, utilizado en NetBSD hasta 6.1.5 y otros productos, podr\u00eda permitir a atacantes dependientes de contexto ejecutar c\u00f3digo arbitrario a trav\u00e9s de una expresi\u00f3n regular grande que conlleva a un desbordamiento de buffer basado en memoria din\u00e1mica."
}
] ,
"metrics" : {
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P" ,
2024-11-22 23:14:22 +00:00
"baseScore" : 6.8 ,
2023-04-24 12:24:31 +02:00
"accessVector" : "NETWORK" ,
"accessComplexity" : "MEDIUM" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "PARTIAL" ,
"integrityImpact" : "PARTIAL" ,
2024-11-22 23:14:22 +00:00
"availabilityImpact" : "PARTIAL"
2023-04-24 12:24:31 +02:00
} ,
"baseSeverity" : "MEDIUM" ,
"exploitabilityScore" : 8.6 ,
"impactScore" : 6.4 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : false
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-190"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:rxspencer_project:rxspencer:3.8.g5:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "6B3E1CB6-5BAF-4CFF-91AB-AE4D26C22209"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*" ,
"matchCriteriaId" : "01EDA41C-6B2E-49AF-B503-EB3882265C11"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*" ,
"matchCriteriaId" : "CB66DB75-2B16-4EBF-9B93-CE49D8086E41"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*" ,
"matchCriteriaId" : "815D70A8-47D3-459C-A32C-9FEACA0659D1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "49A63F39-30BE-443F-AF10-6245587D3359"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F38D3B7E-8429-473F-BB31-FC3583EE5A5B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "16F59A04-14CF-49E2-9973-645477EA09DA"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "A10BC294-9196-425F-9FB0-B1625465B47F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "03117DF1-3BEC-4B8D-AD63-DBBDB2126081"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "5.4.0" ,
"versionEndExcluding" : "5.4.39" ,
"matchCriteriaId" : "9CFE17BD-FDDC-44E1-A8B2-98C2AC60E995"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "5.5.0" ,
"versionEndExcluding" : "5.5.23" ,
"matchCriteriaId" : "2389D7CF-BF9D-4CAD-BBDB-CEEE5161FC44"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "5.6.0" ,
"versionEndExcluding" : "5.6.7" ,
"matchCriteriaId" : "C1BC30A3-DBDB-4DE9-8FDA-5BDF97A0742A"
}
]
}
]
}
] ,
"references" : [
{
"url" : "http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://marc.info/?l=bugtraq&m=143403519711434&w=2" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
2024-11-22 23:14:22 +00:00
{
"url" : "http://marc.info/?l=bugtraq&m=143403519711434&w=2" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
2023-04-24 12:24:31 +02:00
{
"url" : "http://openwall.com/lists/oss-security/2015/02/07/14" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://openwall.com/lists/oss-security/2015/03/11/8" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://php.net/ChangeLog-5.php" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Vendor Advisory"
]
} ,
{
"url" : "http://rhn.redhat.com/errata/RHSA-2015-1053.html" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://rhn.redhat.com/errata/RHSA-2015-1066.html" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://www.debian.org/security/2015/dsa-3195" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://www.kb.cert.org/vuls/id/695940" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Third Party Advisory" ,
"US Government Resource"
]
} ,
{
"url" : "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://www.securityfocus.com/bid/72611" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Third Party Advisory" ,
"VDB Entry"
]
} ,
{
"url" : "http://www.securitytracker.com/id/1031947" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Third Party Advisory" ,
"VDB Entry"
]
} ,
{
"url" : "http://www.ubuntu.com/usn/USN-2572-1" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://www.ubuntu.com/usn/USN-2594-1" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Exploit" ,
"Third Party Advisory"
]
} ,
{
"url" : "https://support.apple.com/HT205267" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Third Party Advisory"
]
2024-11-22 23:14:22 +00:00
} ,
{
"url" : "http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://marc.info/?l=bugtraq&m=143403519711434&w=2" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://marc.info/?l=bugtraq&m=143403519711434&w=2" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://openwall.com/lists/oss-security/2015/02/07/14" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://openwall.com/lists/oss-security/2015/03/11/8" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
} ,
{
"url" : "http://php.net/ChangeLog-5.php" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Vendor Advisory"
]
} ,
{
"url" : "http://rhn.redhat.com/errata/RHSA-2015-1053.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://rhn.redhat.com/errata/RHSA-2015-1066.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://www.debian.org/security/2015/dsa-3195" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://www.kb.cert.org/vuls/id/695940" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Third Party Advisory" ,
"US Government Resource"
]
} ,
{
"url" : "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://www.securityfocus.com/bid/72611" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Third Party Advisory" ,
"VDB Entry"
]
} ,
{
"url" : "http://www.securitytracker.com/id/1031947" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Third Party Advisory" ,
"VDB Entry"
]
} ,
{
"url" : "http://www.ubuntu.com/usn/USN-2572-1" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "http://www.ubuntu.com/usn/USN-2594-1" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Third Party Advisory"
]
} ,
{
"url" : "https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Exploit" ,
"Third Party Advisory"
]
} ,
{
"url" : "https://support.apple.com/HT205267" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Third Party Advisory"
]
2023-04-24 12:24:31 +02:00
}
]
}
