Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2016-3191

The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.

  • Published: Mar 18, 2016
  • Updated: Apr 13, 2023
  • CVE: CVE-2016-3191
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9.8
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
pcre / pcre 8.34 8.34.x
pcre / pcre 8.36 8.36.x
pcre / pcre 8.33 8.33.x
pcre / pcre 8.00 8.00.x
pcre / pcre 8.30 8.30.x
pcre / pcre 8.01 8.01.x
pcre / pcre 8.10 8.10.x
pcre / pcre 8.31 8.31.x
pcre / pcre 8.21 8.21.x
pcre / pcre 8.20 8.20.x
pcre / pcre 8.37 8.37.x
pcre / pcre 8.13 8.13.x
pcre / pcre 8.35 8.35.x
pcre / pcre 8.11 8.11.x
pcre / pcre2 - 10.21.x
pcre / pcre 8.02 8.02.x
pcre / pcre 8.38 8.38.x
pcre / pcre 8.32 8.32.x
pcre / pcre 8.12 8.12.x