CVE-2015-8387: Fedoraproject Fedora

High severity, CVSS 7.3. EPSS: 3.6% chance of exploitation in the next 30 days.

PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Affected products

• Fedoraproject Fedora: version 22 only
• Pcre Perl Compatible Regular Expression Library: up to and including 8.37
• PHP PHP: from 5.5.0, before 5.5.32 (fixed in 5.5.32); from 5.6.0, before 5.6.18 (fixed in 5.6.18); from 7.0.0, before 7.0.3 (fixed in 7.0.3)

Published 2015-12-02. Last modified 2026-06-17.