PublicDateAtUSN: 2015-06-26
Candidate: CVE-2015-5073
PublicDate: 2016-12-13 16:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5073
 http://www.openwall.com/lists/oss-security/2015/06/26/1
 https://ubuntu.com/security/notices/USN-2694-1
 https://ubuntu.com/security/notices/USN-2943-1
Description:
 Heap-based buffer overflow in the find_fixedlength function in
 pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a
 denial of service (crash) or obtain sensitive information from heap memory
 and possibly bypass the ASLR protection mechanism via a crafted regular
 expression with an excess closing parenthesis.
Ubuntu-Description:
Notes:
 mdeslaur> in wily, this was already fixed by the fix_find_fixedlength
 mdeslaur> patch, but the testcases weren't included
 mdeslaur>
 mdeslaur> was supposed to be fixed in wily (2:8.35-7ubuntu2) but got
 mdeslaur> reverted in (2:8.35-7ubuntu5) by mistake
 mdeslaur>
 mdeslaur> CVE-2015-2325_CVE-2015-2326_CVE-2015-3210_CVE-2015-5073.patch
 mdeslaur> in jessie
Bugs:
 https://bugs.exim.org/show_bug.cgi?id=1651
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=790000
 https://bugs.launchpad.net/ubuntu/+source/pcre3/+bug/1396768
Priority: low
Discovered-by:
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H [9.1 CRITICAL]

Patches_pcre3:
 upstream: http://vcs.pcre.org/pcre?view=revision&revision=1571
upstream_pcre3: released (2:8.35-7)
precise_pcre3: released (8.12-4ubuntu0.1)
trusty_pcre3: released (1:8.31-2ubuntu2.1)
trusty/esm_pcre3: released (1:8.31-2ubuntu2.1)
utopic_pcre3: ignored (reached end-of-life)
vivid_pcre3: released (2:8.35-3.3ubuntu1.1)
vivid/stable-phone-overlay_pcre3: released (2:8.35-3.3ubuntu1.1)
vivid/ubuntu-core_pcre3: released (2:8.35-3.3ubuntu1.1)
wily_pcre3: released (2:8.35-7.1ubuntu1.3)
devel_pcre3: not-affected (2:8.38-3)