CVE-2019-16163 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 26%

Vendor	Product	Version
oniguruma_project	oniguruma	𝑥 < 6.9.3
debian	debian_linux	8.0
canonical	ubuntu_linux	14.04

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libonig

bullseye	6.9.6-1.1 fixed
buster	no-dsa
bookworm	6.9.8-1 fixed
sid	6.9.9-1 fixed
trixie	6.9.9-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

libonig

lunar	not-affected
kinetic	not-affected
jammy	not-affected
impish	not-affected
hirsute	not-affected
groovy	not-affected
focal	not-affected
eoan	ignored
disco	ignored
bionic	Fixed 6.7.0-1ubuntu0.1~esm2 released
xenial	Fixed 5.9.6-1ubuntu0.1+esm2 released
trusty	Fixed 5.9.1-1ubuntu1.1+esm2 released

Known Exploits!

Common Weakness Enumeration

CWE-674 - Uncontrolled Recursion
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

References

https://github.com/kkos/oniguruma/commit/4097828d7cc87589864fecf452f2cd46c5f37180

https://github.com/kkos/oniguruma/compare/v6.9.2...v6.9.3

https://github.com/kkos/oniguruma/issues/147

https://lists.debian.org/debian-lts-announce/2019/09/msg00010.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWOWZZNFSAWM3BUTQNAE3PD44A6JU4KE/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZW47MSFZ6WYOAOFXHBDGU4LYACFRKC2Y/

https://usn.ubuntu.com/4460-1/

https://github.com/kkos/oniguruma/commit/4097828d7cc87589864fecf452f2cd46c5f37180

https://github.com/kkos/oniguruma/compare/v6.9.2...v6.9.3

https://github.com/kkos/oniguruma/issues/147

https://lists.debian.org/debian-lts-announce/2019/09/msg00010.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWOWZZNFSAWM3BUTQNAE3PD44A6JU4KE/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZW47MSFZ6WYOAOFXHBDGU4LYACFRKC2Y/

https://usn.ubuntu.com/4460-1/