Security update for pcre SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:2805-1 Final 1 1 2016-11-15T13:43:11Z current 2016-11-15T13:43:11Z 2016-11-15T13:43:11Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for pcre This version fixes a number of vulnerabilities that affect pcre and applications using the libary when accepting untrusted input as regular expressions or as part thereof. Remote attackers could have caused the application to crash, disclose information or potentially execute arbitrary code. - Update to PCRE 8.39 FATE#320298 boo#972127. - CVE-2015-3210: heap buffer overflow in pcre_compile2() / compile_regex() (boo#933288) - CVE-2015-3217: pcre: PCRE Library Call Stack Overflow Vulnerability in match() (boo#933878) - CVE-2015-5073: pcre: Library Heap Overflow Vulnerability in find_fixedlength() (boo#936227) - boo#942865: heap overflow in compile_regex() - CVE-2015-8380: pcre: heap overflow in pcre_exec (boo#957566) - boo#957598: various security issues fixed in pcre 8.37 and 8.38 release - CVE-2016-1283: pcre: Heap buffer overflow in pcre_compile2 causes DoS (boo#960837) - CVE-2016-3191: pcre: workspace overflow for (*ACCEPT) with deeply nested parentheses (boo#971741) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-updates/2016-11/msg00055.html E-Mail link for openSUSE-SU-2016:2805-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE 13.2 libpcre1-8.39-3.8.1 libpcre1-32bit-8.39-3.8.1 libpcre1-debuginfo-8.39-3.8.1 libpcre1-debuginfo-32bit-8.39-3.8.1 libpcre16-0-8.39-3.8.1 libpcre16-0-32bit-8.39-3.8.1 libpcre16-0-debuginfo-8.39-3.8.1 libpcre16-0-debuginfo-32bit-8.39-3.8.1 libpcrecpp0-8.39-3.8.1 libpcrecpp0-32bit-8.39-3.8.1 libpcrecpp0-debuginfo-8.39-3.8.1 libpcrecpp0-debuginfo-32bit-8.39-3.8.1 libpcreposix0-8.39-3.8.1 libpcreposix0-32bit-8.39-3.8.1 libpcreposix0-debuginfo-8.39-3.8.1 libpcreposix0-debuginfo-32bit-8.39-3.8.1 pcre-8.39-3.8.1 pcre-debugsource-8.39-3.8.1 pcre-devel-8.39-3.8.1 pcre-devel-static-8.39-3.8.1 pcre-doc-8.39-3.8.1 pcre-tools-8.39-3.8.1 pcre-tools-debuginfo-8.39-3.8.1 libpcre1-8.39-3.8.1 as a component of openSUSE 13.2 libpcre1-32bit-8.39-3.8.1 as a component of openSUSE 13.2 libpcre1-debuginfo-8.39-3.8.1 as a component of openSUSE 13.2 libpcre1-debuginfo-32bit-8.39-3.8.1 as a component of openSUSE 13.2 libpcre16-0-8.39-3.8.1 as a component of openSUSE 13.2 libpcre16-0-32bit-8.39-3.8.1 as a component of openSUSE 13.2 libpcre16-0-debuginfo-8.39-3.8.1 as a component of openSUSE 13.2 libpcre16-0-debuginfo-32bit-8.39-3.8.1 as a component of openSUSE 13.2 libpcrecpp0-8.39-3.8.1 as a component of openSUSE 13.2 libpcrecpp0-32bit-8.39-3.8.1 as a component of openSUSE 13.2 libpcrecpp0-debuginfo-8.39-3.8.1 as a component of openSUSE 13.2 libpcrecpp0-debuginfo-32bit-8.39-3.8.1 as a component of openSUSE 13.2 libpcreposix0-8.39-3.8.1 as a component of openSUSE 13.2 libpcreposix0-32bit-8.39-3.8.1 as a component of openSUSE 13.2 libpcreposix0-debuginfo-8.39-3.8.1 as a component of openSUSE 13.2 libpcreposix0-debuginfo-32bit-8.39-3.8.1 as a component of openSUSE 13.2 pcre-8.39-3.8.1 as a component of openSUSE 13.2 pcre-debugsource-8.39-3.8.1 as a component of openSUSE 13.2 pcre-devel-8.39-3.8.1 as a component of openSUSE 13.2 pcre-devel-static-8.39-3.8.1 as a component of openSUSE 13.2 pcre-doc-8.39-3.8.1 as a component of openSUSE 13.2 pcre-tools-8.39-3.8.1 as a component of openSUSE 13.2 pcre-tools-debuginfo-8.39-3.8.1 as a component of openSUSE 13.2 Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/, a different vulnerability than CVE-2015-8384. CVE-2015-3210 openSUSE 13.2:libpcre1-32bit-8.39-3.8.1 openSUSE 13.2:libpcre1-8.39-3.8.1 openSUSE 13.2:libpcre1-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcre1-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcre16-0-32bit-8.39-3.8.1 openSUSE 13.2:libpcre16-0-8.39-3.8.1 openSUSE 13.2:libpcre16-0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcre16-0-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-32bit-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcreposix0-32bit-8.39-3.8.1 openSUSE 13.2:libpcreposix0-8.39-3.8.1 openSUSE 13.2:libpcreposix0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcreposix0-debuginfo-8.39-3.8.1 openSUSE 13.2:pcre-8.39-3.8.1 openSUSE 13.2:pcre-debugsource-8.39-3.8.1 openSUSE 13.2:pcre-devel-8.39-3.8.1 openSUSE 13.2:pcre-devel-static-8.39-3.8.1 openSUSE 13.2:pcre-doc-8.39-3.8.1 openSUSE 13.2:pcre-tools-8.39-3.8.1 openSUSE 13.2:pcre-tools-debuginfo-8.39-3.8.1 moderate Please Install the update. http://lists.opensuse.org/opensuse-updates/2016-11/msg00055.html https://www.suse.com/security/cve/CVE-2015-3210.html CVE-2015-3210 https://bugzilla.suse.com/933288 SUSE Bug 933288 https://bugzilla.suse.com/957598 SUSE Bug 957598 https://bugzilla.suse.com/958373 SUSE Bug 958373 PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/. CVE-2015-3217 openSUSE 13.2:libpcre1-32bit-8.39-3.8.1 openSUSE 13.2:libpcre1-8.39-3.8.1 openSUSE 13.2:libpcre1-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcre1-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcre16-0-32bit-8.39-3.8.1 openSUSE 13.2:libpcre16-0-8.39-3.8.1 openSUSE 13.2:libpcre16-0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcre16-0-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-32bit-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcreposix0-32bit-8.39-3.8.1 openSUSE 13.2:libpcreposix0-8.39-3.8.1 openSUSE 13.2:libpcreposix0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcreposix0-debuginfo-8.39-3.8.1 openSUSE 13.2:pcre-8.39-3.8.1 openSUSE 13.2:pcre-debugsource-8.39-3.8.1 openSUSE 13.2:pcre-devel-8.39-3.8.1 openSUSE 13.2:pcre-devel-static-8.39-3.8.1 openSUSE 13.2:pcre-doc-8.39-3.8.1 openSUSE 13.2:pcre-tools-8.39-3.8.1 openSUSE 13.2:pcre-tools-debuginfo-8.39-3.8.1 moderate Please Install the update. http://lists.opensuse.org/opensuse-updates/2016-11/msg00055.html https://www.suse.com/security/cve/CVE-2015-3217.html CVE-2015-3217 https://bugzilla.suse.com/933878 SUSE Bug 933878 https://bugzilla.suse.com/958373 SUSE Bug 958373 Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis. CVE-2015-5073 openSUSE 13.2:libpcre1-32bit-8.39-3.8.1 openSUSE 13.2:libpcre1-8.39-3.8.1 openSUSE 13.2:libpcre1-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcre1-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcre16-0-32bit-8.39-3.8.1 openSUSE 13.2:libpcre16-0-8.39-3.8.1 openSUSE 13.2:libpcre16-0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcre16-0-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-32bit-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcreposix0-32bit-8.39-3.8.1 openSUSE 13.2:libpcreposix0-8.39-3.8.1 openSUSE 13.2:libpcreposix0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcreposix0-debuginfo-8.39-3.8.1 openSUSE 13.2:pcre-8.39-3.8.1 openSUSE 13.2:pcre-debugsource-8.39-3.8.1 openSUSE 13.2:pcre-devel-8.39-3.8.1 openSUSE 13.2:pcre-devel-static-8.39-3.8.1 openSUSE 13.2:pcre-doc-8.39-3.8.1 openSUSE 13.2:pcre-tools-8.39-3.8.1 openSUSE 13.2:pcre-tools-debuginfo-8.39-3.8.1 moderate Please Install the update. http://lists.opensuse.org/opensuse-updates/2016-11/msg00055.html https://www.suse.com/security/cve/CVE-2015-5073.html CVE-2015-5073 https://bugzilla.suse.com/936227 SUSE Bug 936227 The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2015-8380 openSUSE 13.2:libpcre1-32bit-8.39-3.8.1 openSUSE 13.2:libpcre1-8.39-3.8.1 openSUSE 13.2:libpcre1-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcre1-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcre16-0-32bit-8.39-3.8.1 openSUSE 13.2:libpcre16-0-8.39-3.8.1 openSUSE 13.2:libpcre16-0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcre16-0-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-32bit-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcreposix0-32bit-8.39-3.8.1 openSUSE 13.2:libpcreposix0-8.39-3.8.1 openSUSE 13.2:libpcreposix0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcreposix0-debuginfo-8.39-3.8.1 openSUSE 13.2:pcre-8.39-3.8.1 openSUSE 13.2:pcre-debugsource-8.39-3.8.1 openSUSE 13.2:pcre-devel-8.39-3.8.1 openSUSE 13.2:pcre-devel-static-8.39-3.8.1 openSUSE 13.2:pcre-doc-8.39-3.8.1 openSUSE 13.2:pcre-tools-8.39-3.8.1 openSUSE 13.2:pcre-tools-debuginfo-8.39-3.8.1 moderate 4.9 AV:N/AC:L/Au:N/C:N/I:N/A:P Please Install the update. http://lists.opensuse.org/opensuse-updates/2016-11/msg00055.html https://www.suse.com/security/cve/CVE-2015-8380.html CVE-2015-8380 https://bugzilla.suse.com/957566 SUSE Bug 957566 The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVE-2016-1283 openSUSE 13.2:libpcre1-32bit-8.39-3.8.1 openSUSE 13.2:libpcre1-8.39-3.8.1 openSUSE 13.2:libpcre1-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcre1-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcre16-0-32bit-8.39-3.8.1 openSUSE 13.2:libpcre16-0-8.39-3.8.1 openSUSE 13.2:libpcre16-0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcre16-0-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-32bit-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcreposix0-32bit-8.39-3.8.1 openSUSE 13.2:libpcreposix0-8.39-3.8.1 openSUSE 13.2:libpcreposix0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcreposix0-debuginfo-8.39-3.8.1 openSUSE 13.2:pcre-8.39-3.8.1 openSUSE 13.2:pcre-debugsource-8.39-3.8.1 openSUSE 13.2:pcre-devel-8.39-3.8.1 openSUSE 13.2:pcre-devel-static-8.39-3.8.1 openSUSE 13.2:pcre-doc-8.39-3.8.1 openSUSE 13.2:pcre-tools-8.39-3.8.1 openSUSE 13.2:pcre-tools-debuginfo-8.39-3.8.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. http://lists.opensuse.org/opensuse-updates/2016-11/msg00055.html https://www.suse.com/security/cve/CVE-2016-1283.html CVE-2016-1283 https://bugzilla.suse.com/960837 SUSE Bug 960837 The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542. CVE-2016-3191 openSUSE 13.2:libpcre1-32bit-8.39-3.8.1 openSUSE 13.2:libpcre1-8.39-3.8.1 openSUSE 13.2:libpcre1-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcre1-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcre16-0-32bit-8.39-3.8.1 openSUSE 13.2:libpcre16-0-8.39-3.8.1 openSUSE 13.2:libpcre16-0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcre16-0-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-32bit-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcrecpp0-debuginfo-8.39-3.8.1 openSUSE 13.2:libpcreposix0-32bit-8.39-3.8.1 openSUSE 13.2:libpcreposix0-8.39-3.8.1 openSUSE 13.2:libpcreposix0-debuginfo-32bit-8.39-3.8.1 openSUSE 13.2:libpcreposix0-debuginfo-8.39-3.8.1 openSUSE 13.2:pcre-8.39-3.8.1 openSUSE 13.2:pcre-debugsource-8.39-3.8.1 openSUSE 13.2:pcre-devel-8.39-3.8.1 openSUSE 13.2:pcre-devel-static-8.39-3.8.1 openSUSE 13.2:pcre-doc-8.39-3.8.1 openSUSE 13.2:pcre-tools-8.39-3.8.1 openSUSE 13.2:pcre-tools-debuginfo-8.39-3.8.1 important Please Install the update. http://lists.opensuse.org/opensuse-updates/2016-11/msg00055.html https://www.suse.com/security/cve/CVE-2016-3191.html CVE-2016-3191 https://bugzilla.suse.com/971741 SUSE Bug 971741