CVE-2015-8384

Name	CVE-2015-8384
Description	PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8392 and CVE-2015-8395.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pcre3 (PTS)	buster	2:8.39-12	fixed
	bullseye	2:8.39-13	fixed
	bookworm, sid	2:8.39-15	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
pcre3	source	squeeze	(not affected)
pcre3	source	wheezy	(not affected)
pcre3	source	jessie	2:8.35-3.3+deb8u1
pcre3	source	(unstable)	2:8.35-7.2

Notes

[wheezy] - pcre3 <not-affected> (Vulnerable code introduced later)
[squeeze] - pcre3 <not-affected> (Vulnerable code introduced later)
https://bugs.exim.org/show_bug.cgi?id=1636
related issue to CVE-2015-8392 and CVE-2015-8395
Fixed in 8.38
Fixed by http://vcs.pcre.org/pcre?view=revision&revision=1558
Same fixing commit as CVE-2015-3210 but different issues