CoreCVE
Back

CRITICAL

oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read

Published Nov 16, 2019

Description

An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.

Affected products

Remediation

Red Hat statement

This flaw only affected 32-bit compiled versions of Oniguruma. Therefore it did not affect the following 64-bit versions: * PHP and Ruby as shipped with Red Hat Enterprise Linux 7. * PHP and Ruby as shipped with Red Hat Software Collections 3. * PHP as shipped with Red Hat Enterprise Linux 8. * OpenShift containers: openshift4/ose-metering-hadoop, openshift4/ose-metering-hive, openshift4/ose-metering-presto.

Metrics

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-190

Integer Overflow

References (11)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Nov 16, 2019
Updated Aug 5, 2024
Reserved Nov 16, 2019
Link CVE-2019-19012
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-19012
Red Hat
Severity Moderate
Public date Nov 8, 2019
Links CVE-2019-19012 - Bugzilla