CVE-2015-2326

The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".

These are all security issues fixed in the libpcre1-32bit-8.39-2.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apache2-mod_php7-7.0.14-1.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apache2-mod_php5-5.6.28-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libpcre2-16-0-10.22-1.3 package on the GA media of openSUSE Tumbleweed.

  This update fixes the following security issues:
* Logjam attack: mysql uses 512 bit dh groups in SSL [bnc#934789]
* CVE-2015-3152: mysql --ssl does not enforce SSL [bnc#924663]
* CVE-2014-8964: heap buffer overflow [bnc#906574]
* CVE-2015-2325: heap buffer overflow in compile_branch() [bnc#924960]
* CVE-2015-2326: heap buffer overflow in pcre_compile2() [bnc#924961]
* CVE-2015-0501: unspecified vulnerability related to Server:Compiling (CPU April 2015) 
* CVE-2015-2571: unspecified vulnerability related to Server:Optimizer (CPU April 2015)
* CVE-2015-0505: unspecified vulnerability related to Server:DDL (CPU April 2015) 
* CVE-2015-0499: unspecified vulnerability related to Server:Federated (CPU April 2015) 
* CVE-2015-2568: unspecified vulnerability related to Server:Security:Privileges (CPU April 2015) 
* CVE-2015-2573: unspecified vulnerability related to Server:DDL (CPU April 2015)
* CVE-2015-0433: unspecified vulnerability related to Server:InnoDB:DML (CPU April 2015) 
* CVE-2015-0441: unspecified vulnerability related to Server:Security:Encryption (CPU April 2015) 

Michele Spagnuolo discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-8964)

Kai Lu discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-2325, CVE-2015-2326)

Wen Guanxing discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 15.04. (CVE-2015-3210)

It was discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and 14.04 LTS. (CVE-2015-5073)

It was discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly execute arbitrary code.