CVE-2019-13224
Summary
| CVE | CVE-2019-13224 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2019-07-10 14:15:00 UTC |
|---|
| Updated | 2023-11-07 03:03:00 UTC |
|---|
| Description | A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 29 Update: oniguruma-6.9.1-2.fc29 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| support.f5.com/csp/article/K00103182 |
CONFIRM |
support.f5.com |
|
| myF5 |
|
support.f5.com |
|
| [SECURITY] Fedora 29 Update: oniguruma-6.9.1-2.fc29 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| support.f5.com/csp/article/K00103182 |
CONFIRM |
support.f5.com |
|
| Fix CVE-2019-13224: don't allow different encodings for onig_new_delu… · kkos/oniguruma@0f7f61e · GitHub |
CONFIRM |
github.com |
Patch, Third Party Advisory |
| [SECURITY] Fedora 30 Update: oniguruma-6.9.2-2.fc30 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] [DLA 1854-1] libonig security update |
MLIST |
lists.debian.org |
|
| Oniguruma: Multiple vulnerabilities (GLSA 201911-03) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| [SECURITY] Fedora 30 Update: oniguruma-6.9.2-2.fc30 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| USN-4088-1: PHP vulnerability | Ubuntu security notices | Ubuntu |
UBUNTU |
usn.ubuntu.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 161367 Oracle Enterprise Linux Security Update for oniguruma (ELSA-2024-0889)
- 242761 Red Hat Update for oniguruma (RHSA-2024:0409)
- 242799 Red Hat Update for oniguruma (RHSA-2024:0572)
- 242940 Red Hat Update for oniguruma (RHSA-2024:0889)
- 296079 Oracle Solaris 11.4 Support Repository Update (SRU) 15.5.0 Missing (CPUOCT2019)
- 501148 Alpine Linux Security Update for php7
- 710120 Gentoo Linux Oniguruma Multiple vulnerabilities (GLSA 201911-03)
- 752604 SUSE Enterprise Linux Security Update for oniguruma (SUSE-SU-2022:3327-1)
- 905150 Common Base Linux Mariner (CBL-Mariner) Security Update for jq (12499)
- 940250 AlmaLinux Security Update for php:7.3 (ALSA-2020:3662)
- 941585 AlmaLinux Security Update for oniguruma (ALSA-2024:0889)
- 960421 Rocky Linux Security Update for php:7.3 (RLSA-2020:3662)
