CVE-2019-13224
10.07.2019, 14:15
A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.Enginsight
| Vendor | Product | Version |
|---|---|---|
| oniguruma_project | oniguruma | 6.9.2 |
| php | php | 7.1.0 ≤ 𝑥 < 7.1.32 |
| php | php | 7.2.0 ≤ 𝑥 < 7.2.23 |
| php | php | 7.3.0 ≤ 𝑥 < 7.3.9 |
| debian | debian_linux | 8.0 |
| canonical | ubuntu_linux | 12.04 |
| canonical | ubuntu_linux | 14.04 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| groonga |
| ||||||||||||||||||||||||||||||
| libevhtp |
| ||||||||||||||||||||||||||||||
| libonig |
| ||||||||||||||||||||||||||||||
| mudlet |
| ||||||||||||||||||||||||||||||
| php5 |
| ||||||||||||||||||||||||||||||
| php7.0 |
| ||||||||||||||||||||||||||||||
| php7.2 |
| ||||||||||||||||||||||||||||||
| php7.3 |
|
Common Weakness Enumeration
References