CVE-2016-1283

Description

The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

How to fix CVE-2016-1283

To remediate CVE-2016-1283, upgrade the affected package to a fixed version below.

• —upgrade to 8.38-r1 or later
• —upgrade to 5.6.32-r0 or later
• —upgrade to 2:8.38-3.1 or later

Is CVE-2016-1283 being exploited?

Low — EPSS is 2.4%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 8.38-r1
• from 0, < 5.6.32-r0
• from 0, < 2:8.38-3.1

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2016-1283
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2016-1283