NetSight
IP …
critical9.8

CVE-2019-13224

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possib…

Impact

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

Affected products

VendorProductAffected versions
Oniguruma ProjectOniguruma
Version 6.9.2
PhpPhp
from 7.1.0 before 7.1.32
from 7.2.0 before 7.2.23
from 7.3.0 before 7.3.9
FedoraprojectFedora
Versions 29, 30
DebianDebian Linux
Version 8.0
CanonicalUbuntu Linux
Versions 12.04, 14.04

Weakness classification

CWE-416

References