QwikSec

Security Database

CVE

CWE

Training

CVE-2015-2305

Published: Mar 30, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vdb-entry

x_refsource_BID

vendor-advisory

x_refsource_DEBIAN

[oss-security] 20150311 Re: CVE request: spencer regexp

mailing-list

x_refsource_MLIST

openSUSE-SU-2015:0644

vendor-advisory

x_refsource_SUSE

APPLE-SA-2015-09-30-3

vendor-advisory

x_refsource_APPLE

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

x_refsource_CONFIRM

vendor-advisory

x_refsource_HP

vdb-entry

x_refsource_SECTRACK

http://php.net/ChangeLog-5.php

x_refsource_CONFIRM

SUSE-SU-2015:0868

vendor-advisory

x_refsource_SUSE

vendor-advisory

x_refsource_UBUNTU

https://support.apple.com/HT205267

x_refsource_CONFIRM

vendor-advisory

x_refsource_UBUNTU

http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html

x_refsource_CONFIRM

SUSE-SU-2015:0946

vendor-advisory

x_refsource_SUSE

third-party-advisory

x_refsource_CERT-VN

openSUSE-SU-2015:0906

vendor-advisory

x_refsource_SUSE

[oss-security] 20150207 Spencer regexp heap overflow?

mailing-list

x_refsource_MLIST

https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/

x_refsource_MISC

vendor-advisory

x_refsource_REDHAT

vendor-advisory

x_refsource_HP

vendor-advisory

x_refsource_REDHAT

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.