« Volver al listado

CVE-2015-2327

Estado: ModificadaAlta (7.5)—

PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pcre — Perl Compatible Regular Expression Library

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-2327",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-12-02T01:59:00.113",
  "references": [
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.fortiguard.com/advisory/FG-VD-15-010/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/11/29/1",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/74924",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.exim.org/show_bug.cgi?id=1503",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://jira.mongodb.org/browse/SERVER-17252",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.fortiguard.com/advisory/FG-VD-15-010/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/11/29/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/74924",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.exim.org/show_bug.cgi?id=1503",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jira.mongodb.org/browse/SERVER-17252",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PCRE before 8.36 mishandles the /(((a\\2)|(a*)\\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror."
    },
    {
      "lang": "es",
      "value": "PCRE en versiones anteriores a 8.36 no maneja correctamente el patrón /(((a\\2)|(a*)\\g<-1>))*/ y patrones relacionados con ciertas referencias hacia atrás recursivas internas, lo que permite a atacantes remotos causar una denegación de servicio (fallo de segmentación) o posiblemente tener otro impacto no especificado a través de una expresión regular manipulada, según lo demostrado por un objeto JavaScript RegExp encontrado por Konqueror."
    }
  ],
  "lastModified": "2026-06-17T00:23:55.907",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pcre:perl_compatible_regular_expression_library:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7106DEF-BDA5-4354-A5A7-4EE1D3344A68",
              "versionEndIncluding": "8.35"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}