// For flags

CVE-2015-3217

pcre: stack overflow caused by mishandled group empty match (8.38/11)

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.

PCRE 7.8 y 8.32 hasta la versión 8.37 y PCRE2 10.10 no maneja adecuadamente las partidas de grupo vacías, lo que podrían permitir a atacantes remotos provocar una denegación de servicio (desbordamientos de búfer basado en pila) a través de una expresión regular manipulada, según lo demostrado por /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. The memcache, mongo, and XDebug extensions are also included. The rh-php56 Software Collection has been upgraded to version 5.6.25, which provides a number of bug fixes and enhancements over the previous version. Security Fixes in the rh-php56-php component have been added.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2015-04-10 CVE Reserved
  • 2016-05-12 CVE Published
  • 2024-08-06 CVE Updated
  • 2024-08-06 First Exploit
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-674: Uncontrolled Recursion
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Pcre
Search vendor "Pcre"
 Pcre2
Search vendor "Pcre" for product "Pcre2"
 10.10
Search vendor "Pcre" for product "Pcre2" and version "10.10"
-
Affected
Pcre
Search vendor "Pcre"
 Pcre
Search vendor "Pcre" for product "Pcre"
 7.8
Search vendor "Pcre" for product "Pcre" and version "7.8"
-
Affected
Pcre
Search vendor "Pcre"
 Pcre
Search vendor "Pcre" for product "Pcre"
 8.32
Search vendor "Pcre" for product "Pcre" and version "8.32"
-
Affected
Pcre
Search vendor "Pcre"
 Pcre
Search vendor "Pcre" for product "Pcre"
 8.33
Search vendor "Pcre" for product "Pcre" and version "8.33"
-
Affected
Pcre
Search vendor "Pcre"
 Pcre
Search vendor "Pcre" for product "Pcre"
 8.34
Search vendor "Pcre" for product "Pcre" and version "8.34"
-
Affected
Pcre
Search vendor "Pcre"
 Pcre
Search vendor "Pcre" for product "Pcre"
 8.35
Search vendor "Pcre" for product "Pcre" and version "8.35"
-
Affected
Pcre
Search vendor "Pcre"
 Pcre
Search vendor "Pcre" for product "Pcre"
 8.36
Search vendor "Pcre" for product "Pcre" and version "8.36"
-
Affected
Pcre
Search vendor "Pcre"
 Pcre
Search vendor "Pcre" for product "Pcre"
 8.37
Search vendor "Pcre" for product "Pcre" and version "8.37"
-
Affected
Ibm
Search vendor "Ibm"
 Powerkvm
Search vendor "Ibm" for product "Powerkvm"
 2.1
Search vendor "Ibm" for product "Powerkvm" and version "2.1"
-
Affected
Ibm
Search vendor "Ibm"
 Powerkvm
Search vendor "Ibm" for product "Powerkvm"
 3.1
Search vendor "Ibm" for product "Powerkvm" and version "3.1"
-
Affected