Integer overflow in NetBSD - CVE-2015-2305
Published: November 27, 2018
Vulnerability identifier: #VU16110
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-2305
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to execute arbitrary code on the target system.
The vulnerability exists due to \integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products. A local attacker can trigger heap-based buffer overflow via a large regular expression and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
NetBSD
Amazon Linux AMI
Slackware Linux
Fedora
php5 (Ubuntu package)
php
Amazon Linux AMI
Slackware Linux
Fedora
php5 (Ubuntu package)
php
How to mitigate CVE-2015-2305
Install update from vendor's website.
php5 (Ubuntu package) - addressed in versions 5.3.2-1ubuntu4.30, 5.3.10-1ubuntu3.18, 5.5.9+dfsg-1ubuntu4.9, 5.5.12+dfsg-2ubuntu4.4
php - addressed in versions 5.6.7-1.fc21, 5.6.7-2.fc22
php - addressed in versions 5.6.7-1.fc21, 5.6.7-2.fc22
External References
- http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html
- http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html
- http://marc.info/?l=bugtraq&m=143403519711434&w=2
- http://openwall.com/lists/oss-security/2015/02/07/14
- http://openwall.com/lists/oss-security/2015/03/11/8
- http://php.net/ChangeLog-5.php
- http://rhn.redhat.com/errata/RHSA-2015-1053.html
- http://rhn.redhat.com/errata/RHSA-2015-1066.html
- http://www.debian.org/security/2015/dsa-3195
- http://www.kb.cert.org/vuls/id/695940
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/72611
- http://www.securitytracker.com/id/1031947
- http://www.ubuntu.com/usn/USN-2572-1
- http://www.ubuntu.com/usn/USN-2594-1
- https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/
- https://support.apple.com/HT205267