SB20200114101 - Multiple vulnerabilities in PCRE PCRE

Description

This security bulletin contains information about 2 vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2015-2325)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary error in the compile_branch function. A remote attacker can create a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

2) Out-of-bounds read (CVE-ID: CVE-2015-2326)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.

The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(1))/".

Remediation

Install update from vendor's website.

References

• http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html
• https://bugs.exim.org/show_bug.cgi?id=1591
• https://fortiguard.com/zeroday/FG-VD-15-015
• https://www.pcre.org/original/changelog.txt
• https://bugs.exim.org/show_bug.cgi?id=1592
• https://fortiguard.com/zeroday/FG-VD-15-016