CVEvulnerability

CVE-2019-13224

9.8 CRITICAL Published 2019-07-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-07-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-416

Description

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

Affected configurations

• oniguruma project oniguruma 6.9.2 • php php (>= 7.1.0 < 7.1.32) • php php (>= 7.2.0 < 7.2.23) • php php (>= 7.3.0 < 7.3.9) • fedoraproject fedora 29 • fedoraproject fedora 30 • debian debian linux 8.0 • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04

Related

Weakness · CWE (1)

References