CVE:CVE-2015-2305
CNNVD:CNNVD-201503-098
NetBSD是NetBSD基金会开发的一套免费开源的类Unix操作系统。Henry Spencer BSD regex library（又名rxspencer）是加拿大软件开发者Henry Spencer所研发的一套使用C语言编写的正则表达式软件库。
NetBSD 6.1.5及之前版本中使用的32-bit平台上的Henry Spencer BSD regex library alpha3.8.g5版本中的regcomp实现过程中存在整数溢出漏洞。攻击者可借助超大的正则表达式利用该漏洞执行任意代码。
solution:Upgrade rxspencer_project rxspencer to a higher version than 3.8.g5,and avoid the version 3.8.g5; Upgrade canonical ubuntu_linux to a higher version than 10.04,12.04,14.04,14.10,15.04,and avoid the version 10.04,12.04,14.04,14.10,15.04; Upgrade debian debian_linux to a higher version than 7.0,8.0,and avoid the version 7.0,8.0; Upgrade opensuse opensuse to a higher version than 13.1,13.2,and avoid the version 13.1,13.2; Upgrade php php to a higher version than 5.4.39,5.5.23,5.6.7,and avoid the version [5.4.0,5.4.39),[5.5.0,5.5.23),[5.6.0,5.6.7)