An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pgsqlUpgrade php-gmpUpgrade php-develUpgrade php-pecl-zipUpgrade php-commonUpgrade php-pecl-rrdUpgrade php-mbstringUpgrade php-odbcUpgrade php-processUpgrade php-pearUpgrade php-pecl-xdebugUpgrade onigurumaUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-fpmUpgrade php-xmlrpcUpgrade php-jsonUpgrade php-soapUpgrade php-enchantUpgrade php-recodeUpgrade apcu-panelUpgrade php-cliUpgrade php-opcacheUpgrade phpUpgrade libzip-develUpgrade php-bcmathUpgrade php-dbgUpgrade php-pecl-apcuUpgrade libzip-toolsUpgrade php-intlUpgrade php-snmpUpgrade php-dbaUpgrade php-gdUpgrade php-mysqlndUpgrade oniguruma-develUpgrade php-xmlUpgrade libzipUpgrade php-embeddedUpgrade php-ldap | May 4, 2022 | Nov 21, 2019 |
| Alpine Linux | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade php-xmlrpcUpgrade php-mysqlndUpgrade php-debuginfoUpgrade php-cliUpgrade php-processUpgrade php-intlUpgrade php-odbcUpgrade php-snmpUpgrade php-mbstringUpgrade php-commonUpgrade php-pgsqlUpgrade php-xmlUpgrade php-dbaUpgrade phpUpgrade php-develUpgrade php-gdUpgrade php-enchantUpgrade php-soapUpgrade php-recodeUpgrade php-embeddedUpgrade php-ldapUpgrade php-fpmUpgrade php-bcmathUpgrade php-pspellUpgrade php-pdo | Apr 25, 2025 | Nov 21, 2019 |
| Centos_linux | — | Upgrade php-opcache-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-cli-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-common-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-dbgUpgrade php-dba-debuginfoUpgrade php-commonUpgrade php-debuginfoUpgrade php-ldapUpgrade php-pecl-zip-debugsourceUpgrade php-enchant-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pdo-debuginfoUpgrade php-soap-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pgsqlUpgrade libzip-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-odbcUpgrade php-process-debuginfoUpgrade php-pecl-apcuUpgrade apcu-panelUpgrade php-intlUpgrade php-json-debuginfoUpgrade php-xml-debuginfoUpgrade php-gmp-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-apcu-develUpgrade php-xmlUpgrade php-recodeUpgrade libzip-toolsUpgrade php-bcmath-debuginfoUpgrade php-dbg-debuginfoUpgrade php-bcmathUpgrade php-recode-debuginfoUpgrade php-mbstringUpgrade php-develUpgrade php-intl-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-embedded-debuginfoUpgrade php-pecl-rrdUpgrade php-gmpUpgrade php-opcacheUpgrade php-mysqlndUpgrade php-fpmUpgrade phpUpgrade php-snmpUpgrade php-pearUpgrade php-xmlrpcUpgrade php-jsonUpgrade php-pecl-zipUpgrade php-debugsourceUpgrade php-pecl-xdebugUpgrade php-pdoUpgrade php-gd-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade libzip-develUpgrade php-soapUpgrade php-embeddedUpgrade php-dbaUpgrade php-pecl-apcu-debuginfoUpgrade php-snmp-debuginfoUpgrade php-processUpgrade php-cliUpgrade php-gdUpgrade php-pgsql-debuginfoUpgrade php-ldap-debuginfoUpgrade libzipUpgrade php-enchantUpgrade libzip-tools-debuginfoUpgrade libzip-debugsource | Sep 9, 2020 | Nov 21, 2019 |
| Debian | — | Upgrade libonig | Nov 6, 2020 | Nov 21, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-odbcUpgrade php-ldapUpgrade php-soapUpgrade php-commonUpgrade php-pgsqlUpgrade phpUpgrade php-xmlUpgrade php-gdUpgrade php-xmlrpcUpgrade php-cliUpgrade php-recodeUpgrade php-processUpgrade php-mysqlUpgrade php-pdo | Oct 26, 2021 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.4-11.4.17.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 21, 2019 |
| Oracle_linux | — | Upgrade php-enchantUpgrade php-soapUpgrade php-recodeUpgrade libzipUpgrade php-intlUpgrade oniguruma-develUpgrade php-opcacheUpgrade libzip-toolsUpgrade php-bcmathUpgrade php-ldapUpgrade php-pgsqlUpgrade phpUpgrade php-pecl-apcuUpgrade php-pecl-zipUpgrade php-mysqlndUpgrade php-odbcUpgrade php-snmpUpgrade php-dbaUpgrade php-commonUpgrade apcu-panelUpgrade libzip-develUpgrade php-dbgUpgrade php-embeddedUpgrade php-gmpUpgrade php-jsonUpgrade php-xmlrpcUpgrade php-pecl-apcu-develUpgrade php-fpmUpgrade php-pecl-rrdUpgrade php-xmlUpgrade php-pdoUpgrade php-mbstringUpgrade php-develUpgrade php-cliUpgrade php-processUpgrade php-pearUpgrade php-pecl-xdebugUpgrade onigurumaUpgrade php-gd | Sep 10, 2020 | Nov 6, 2019 |
| Redhat_linux | — | Upgrade php-pearUpgrade libzip-tools-debuginfoUpgrade php-ldap-debuginfoUpgrade php-soapUpgrade php-pecl-apcu-develUpgrade php-intl-debuginfoUpgrade libzip-toolsUpgrade php-xmlUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-xdebugUpgrade php-dbaUpgrade php-snmpUpgrade php-snmp-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-fpmUpgrade php-mysqlnd-debuginfoUpgrade php-processUpgrade oniguruma-debugsourceUpgrade php-recode-debuginfoUpgrade php-pecl-rrdUpgrade php-mbstringUpgrade php-cliUpgrade onigurumaUpgrade php-recodeUpgrade php-xmlrpcUpgrade libzip-debugsourceUpgrade php-debuginfoUpgrade php-dbg-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-soap-debuginfoUpgrade php-odbc-debuginfoUpgrade php-gdUpgrade php-opcache-debuginfoUpgrade php-embeddedUpgrade php-odbcUpgrade php-fpm-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pdoUpgrade libzip-develUpgrade php-mbstring-debuginfoUpgrade php-dbgUpgrade php-pecl-zip-debuginfoUpgrade oniguruma-develUpgrade php-pecl-xdebug-debugsourceUpgrade php-develNo solution existsUpgrade oniguruma-debuginfoUpgrade libzipUpgrade php-mysqlndUpgrade php-bcmathUpgrade php-enchantUpgrade php-enchant-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-intlUpgrade php-pdo-debuginfoUpgrade php-ldapUpgrade php-json-debuginfoUpgrade php-jsonUpgrade php-pgsqlUpgrade php-opcacheUpgrade php-embedded-debuginfoUpgrade libzip-debuginfoUpgrade php-commonUpgrade php-gmpUpgrade php-pecl-apcuUpgrade php-debugsourceUpgrade phpUpgrade php-pgsql-debuginfoUpgrade php-cli-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-process-debuginfoUpgrade php-gd-debuginfoUpgrade php-pecl-zipUpgrade php-common-debuginfoUpgrade php-gmp-debuginfoUpgrade php-dba-debuginfoUpgrade php-xml-debuginfoUpgrade apcu-panel | Sep 9, 2020 | Nov 21, 2019 |
| Rocky_linux | — | Upgrade php-odbc-debuginfoUpgrade php-pecl-apcu-develUpgrade php-cli-debuginfoUpgrade libzip-debuginfoUpgrade php-gmp-debuginfoUpgrade php-dba-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade phpUpgrade php-ldap-debuginfoUpgrade php-common-debuginfoUpgrade libzipUpgrade php-debuginfoUpgrade php-fpm-debuginfoUpgrade php-json-debuginfoUpgrade php-pdo-debuginfoUpgrade php-intlUpgrade php-soap-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-ldapUpgrade php-commonUpgrade php-dbgUpgrade php-soapUpgrade php-bcmath-debuginfoUpgrade php-dbaUpgrade php-pecl-zip-debuginfoUpgrade php-xml-debuginfoUpgrade php-pgsqlUpgrade php-mbstring-debuginfoUpgrade php-pecl-zipUpgrade libzip-tools-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-snmp-debuginfoUpgrade libzip-toolsUpgrade php-gd-debuginfoUpgrade php-odbcUpgrade libzip-debugsourceUpgrade php-pecl-xdebugUpgrade php-develUpgrade php-opcache-debuginfoUpgrade php-mysqlndUpgrade php-processUpgrade php-embeddedUpgrade php-embedded-debuginfoUpgrade php-enchantUpgrade php-cliUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-jsonUpgrade php-intl-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-recode-debuginfoUpgrade php-recodeUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-rrdUpgrade php-gdUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-fpmUpgrade php-pecl-apcuUpgrade php-dbg-debuginfoUpgrade php-snmpUpgrade php-mbstringUpgrade php-gmpUpgrade php-pecl-zip-debugsourceUpgrade php-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-bcmathUpgrade php-pdoUpgrade libzip-develUpgrade php-opcacheUpgrade php-enchant-debuginfo | Mar 12, 2024 | Nov 21, 2019 |
| Suse | — | Upgrade libonig4Upgrade oniguruma-devel | Aug 9, 2024 | Nov 21, 2019 |
| Ubuntu | — | Upgrade libonig4 (Ubuntu Pro)Upgrade libonig2 (Ubuntu Pro) | Mar 22, 2023 | Nov 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub