CVE-2015-8390: Fedoraproject Fedora

Critical severity, CVSS 9.8. EPSS: 4.7% chance of exploitation in the next 30 days.

PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

Affected products

• Fedoraproject Fedora: version 22 only
• Pcre Perl Compatible Regular Expression Library: up to and including 8.37
• PHP PHP: from 5.5.0, before 5.5.32 (fixed in 5.5.32); from 5.6.0, before 5.6.18 (fixed in 5.6.18); from 7.0.0, before 7.0.3 (fixed in 7.0.3)

Published 2015-12-02. Last modified 2026-06-17.