pcre-8.32-15.el7.1

Perl-compatible regular expression library.
PCRE has its own native API, but a set of "wrapper" functions that are based on
the POSIX API are also supplied in the library libpcreposix. Note that this
just provides a POSIX calling interface to PCRE: the regular expressions
themselves still follow Perl syntax and semantics. The header file
for the POSIX-style functions is called pcreposix.h.

Security issues fixed with this release:

CVE-2015-2328
PCRE before 8.36 mishandles the /((?(R)a|(?1))) / pattern and related
patterns with certain recursion, which allows remote attackers to
cause a denial of service (segmentation fault) or possibly have
unspecified other impact via a crafted regular expression, as
demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVE-2015-3217
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2015-5073
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2015-8385
PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and
related patterns with certain forward references, which allows remote
attackers to cause a denial of service (buffer overflow) or possibly
have unspecified other impact via a crafted regular expression, as
demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVE-2015-8386
PCRE before 8.38 mishandles the interaction of lookbehind assertions
and mutually recursive subpatterns, which allows remote attackers to
cause a denial of service (buffer overflow) or possibly have
unspecified other impact via a crafted regular expression, as
demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVE-2015-8388
PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and
related patterns with an unmatched closing parenthesis, which allows
remote attackers to cause a denial of service (buffer overflow) or
possibly have unspecified other impact via a crafted regular
expression, as demonstrated by a JavaScript RegExp object encountered
by Konqueror.
CVE-2015-8391
The pcre_compile function in pcre_compile.c in PCRE before 8.38
mishandles certain [: nesting, which allows remote attackers to cause
a denial of service (CPU consumption) or possibly have unspecified
other impact via a crafted regular expression, as demonstrated by a
JavaScript RegExp object encountered by Konqueror.
CVE-2016-3191
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39
and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns
containing an (*ACCEPT) substring in conjunction with nested
parentheses, which allows remote attackers to execute arbitrary code
or cause a denial of service (stack-based buffer overflow) via a
crafted regular expression, as demonstrated by a JavaScript RegExp
object encountered by Konqueror, aka ZDI-CAN-3542.