CVE-2016-3191
Description
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.
Risk Information
Base Score
9.8
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
11.337
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| (RHSA-2016:1025) Important: pcre security update pcre-8.32-15.el7_2.1.i686.rpm | Linux |
| (RHSA-2016:1025) Important: pcre security update pcre-8.32-15.el7_2.1.x86_64.rpm | Linux |
| (RHSA-2016:1025) Important: pcre security update pcre-devel-8.32-15.el7_2.1.i686.rpm | Linux |
| (RHSA-2016:1025) Important: pcre security update pcre-devel-8.32-15.el7_2.1.x86_64.rpm | Linux |
| (RHSA-2016:1025) Important: pcre security update pcre-static-8.32-15.el7_2.1.i686.rpm | Linux |
| (RHSA-2016:1025) Important: pcre security update pcre-static-8.32-15.el7_2.1.x86_64.rpm | Linux |
| (RHSA-2016:1025) Important: pcre security update pcre-tools-8.32-15.el7_2.1.x86_64.rpm | Linux |
| (RHSA-2016:1025)Important: security update pcre-debuginfo-8.32-15.el7_2.1.i686.rpm | Linux |
| (RHSA-2016:1025)Important: security update pcre-debuginfo-8.32-15.el7_2.1.x86_64.rpm | Linux |
| Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-3191) | NCM |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234