A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-enchantUpgrade php-opcacheUpgrade php-embeddedUpgrade php-dbaUpgrade php-pgsqlUpgrade libzip-toolsUpgrade php-dbgUpgrade php-gdUpgrade php-ldapUpgrade libzip-develUpgrade php-pecl-rrdUpgrade apcu-panelUpgrade php-soapUpgrade php-odbcUpgrade oniguruma-develUpgrade phpUpgrade php-intlUpgrade php-processUpgrade php-pecl-apcu-develUpgrade php-cliUpgrade php-pearUpgrade php-bcmathUpgrade php-fpmUpgrade php-recodeUpgrade php-pdoUpgrade php-develUpgrade php-mbstringUpgrade php-xmlrpcUpgrade php-commonUpgrade php-mysqlndUpgrade php-pecl-apcuUpgrade php-jsonUpgrade onigurumaUpgrade php-snmpUpgrade php-pecl-zipUpgrade php-xmlUpgrade php-pecl-xdebugUpgrade libzipUpgrade php-gmp | May 4, 2022 | Jul 10, 2019 |
| Alpine Linux | — | Upgrade php7 | Nov 27, 2019 | Jul 10, 2019 |
| Amazon Linux Ami 2 | — | Upgrade onigurumaUpgrade oniguruma-debuginfoUpgrade oniguruma-devel | Apr 27, 2020 | Jul 10, 2019 |
| Amazon_linux | — | Upgrade php71Upgrade php73Upgrade oniguruma | Sep 19, 2019 | Jul 10, 2019 |
| Centos_linux | — | Upgrade php-pecl-apcu-debuginfoUpgrade php-pecl-xdebugUpgrade php-dbg-debuginfoUpgrade php-embeddedUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-rrdUpgrade php-fpmUpgrade php-pearUpgrade php-ldap-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-debugsourceUpgrade php-opcacheUpgrade php-recodeUpgrade php-processUpgrade php-gmpUpgrade php-snmp-debuginfoUpgrade php-xmlrpcUpgrade php-jsonUpgrade php-develUpgrade php-pdoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-zipUpgrade php-intl-debuginfoUpgrade libzip-develUpgrade libzip-tools-debuginfoUpgrade php-debuginfoUpgrade php-snmpUpgrade php-enchantUpgrade php-gdUpgrade php-mysqlndUpgrade php-xmlUpgrade php-mbstringUpgrade php-recode-debuginfoUpgrade php-embedded-debuginfoUpgrade php-opcache-debuginfoUpgrade php-cliUpgrade php-process-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade libzip-toolsUpgrade php-pecl-zip-debuginfoUpgrade php-ldapUpgrade php-pgsql-debuginfoUpgrade php-odbcUpgrade php-pecl-xdebug-debuginfoUpgrade php-soap-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pecl-apcuUpgrade php-gmp-debuginfoUpgrade php-pdo-debuginfoUpgrade php-intlUpgrade php-dbaUpgrade phpUpgrade php-pecl-apcu-develUpgrade php-commonUpgrade php-cli-debuginfoUpgrade php-bcmathUpgrade php-json-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade libzip-debuginfoUpgrade php-soapUpgrade php-dbgUpgrade libzip-debugsourceUpgrade libzipUpgrade php-odbc-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-common-debuginfoUpgrade php-xml-debuginfoUpgrade php-gd-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pgsqlUpgrade php-dba-debuginfoUpgrade php-mbstring-debuginfoUpgrade apcu-panel | Sep 9, 2020 | Jul 10, 2019 |
| Debian | — | Upgrade libonig | Jul 22, 2019 | Jul 10, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade oniguruma | Sep 8, 2019 | Sep 7, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/oniguruma. | Nov 8, 2019 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-ldapUpgrade php-odbcUpgrade php-gdUpgrade php-pgsqlUpgrade php-pdoUpgrade php-processUpgrade php-soapUpgrade php-mysqlUpgrade php-cliUpgrade php-xmlrpcUpgrade php-recodeUpgrade phpUpgrade php-xmlUpgrade php-common | Nov 3, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-odbcUpgrade php-xmlUpgrade php-cliUpgrade php-pgsqlUpgrade php-mysqlUpgrade php-commonUpgrade php-recodeUpgrade php-xmlrpcUpgrade php-gdUpgrade php-processUpgrade php-soapUpgrade php-pdoUpgrade phpUpgrade php-ldap | Sep 28, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Sep 30, 2019 | Jul 10, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.3-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Jul 10, 2019 |
| Oracle_linux | — | Upgrade php-dbaUpgrade php-opcacheUpgrade php-gdUpgrade php-processUpgrade php-pgsqlUpgrade php-mbstringUpgrade OVMFUpgrade php-soapUpgrade php-pecl-rrdUpgrade php-snmpUpgrade php-intlUpgrade libzip-develUpgrade libzip-toolsUpgrade php-mysqlndUpgrade oniguruma-develUpgrade phpUpgrade apcu-panelUpgrade php-pecl-apcuUpgrade php-fpmUpgrade php-odbcUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-enchantUpgrade php-dbgUpgrade php-ldapUpgrade php-gmpUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-recodeUpgrade php-commonUpgrade onigurumaUpgrade php-embeddedUpgrade php-pecl-zipUpgrade libzipUpgrade php-pecl-xdebugUpgrade php-jsonUpgrade php-develUpgrade php-bcmathUpgrade php-cliUpgrade AAVMFUpgrade php-pear | Sep 10, 2020 | Jun 27, 2019 |
| Php | — | Upgrade to PHP version 7.1.32Upgrade to PHP version 7.3.9Upgrade to PHP version 7.2.23 | Sep 15, 2022 | Jul 10, 2019 |
| Redhat_linux | — | Upgrade php-develUpgrade php-xml-debuginfoUpgrade php-cli-debuginfoUpgrade php-dbaUpgrade php-pecl-xdebugUpgrade php-bcmathUpgrade php-pecl-zip-debugsourceUpgrade php-jsonUpgrade php-xmlrpc-debuginfoUpgrade php-processUpgrade php-mbstring-debuginfoNo solution existsUpgrade libzip-tools-debuginfoUpgrade php-odbcUpgrade php-xmlrpcUpgrade php-opcache-debuginfoUpgrade php-commonUpgrade php-dba-debuginfoUpgrade php-dbg-debuginfoUpgrade php-gdUpgrade php-pdo-debuginfoUpgrade php-soapUpgrade php-odbc-debuginfoUpgrade php-mbstringUpgrade php-intl-debuginfoUpgrade php-pdoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcu-develUpgrade php-enchant-debuginfoUpgrade php-pecl-zipUpgrade php-pecl-apcuUpgrade php-fpmUpgrade php-pecl-rrd-debuginfoUpgrade php-json-debuginfoUpgrade php-pgsqlUpgrade php-gmpUpgrade libzip-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-rrdUpgrade libzip-debugsourceUpgrade oniguruma-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pearUpgrade php-intlUpgrade oniguruma-debugsourceUpgrade php-common-debuginfoUpgrade php-dbgUpgrade php-snmpUpgrade libzip-toolsUpgrade php-debugsourceUpgrade php-bcmath-debuginfoUpgrade php-snmp-debuginfoUpgrade php-recodeUpgrade php-debuginfoUpgrade phpUpgrade php-gmp-debuginfoUpgrade oniguruma-develUpgrade php-process-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-soap-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-recode-debuginfoUpgrade php-embeddedUpgrade php-ldap-debuginfoUpgrade libzip-develUpgrade onigurumaUpgrade php-ldapUpgrade php-fpm-debuginfoUpgrade php-opcacheUpgrade php-gd-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pgsql-debuginfoUpgrade apcu-panelUpgrade php-mysqlndUpgrade php-xmlUpgrade php-cliUpgrade php-embedded-debuginfoUpgrade php-enchantUpgrade php-pecl-apcu-debugsourceUpgrade libzip | Sep 9, 2020 | Jul 10, 2019 |
| Rocky_linux | — | Upgrade php-cliUpgrade php-embedded-debuginfoUpgrade php-recode-debuginfoUpgrade php-mysqlndUpgrade php-embeddedUpgrade php-enchantUpgrade php-bcmath-debuginfoUpgrade php-xmlUpgrade php-ldap-debuginfoUpgrade php-gdUpgrade php-soap-debuginfoUpgrade phpUpgrade libzip-toolsUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-pecl-rrdUpgrade libzip-develUpgrade php-pecl-xdebugUpgrade php-ldapUpgrade php-bcmathUpgrade php-snmpUpgrade php-gd-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade libzipUpgrade php-pgsql-debuginfoUpgrade php-intlUpgrade php-pecl-zipUpgrade php-snmp-debuginfoUpgrade php-opcacheUpgrade php-processUpgrade php-gmp-debuginfoUpgrade php-dbg-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-dbaUpgrade php-pecl-zip-debuginfoUpgrade php-odbcUpgrade php-mbstring-debuginfoUpgrade php-mbstringUpgrade php-fpmUpgrade php-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-enchant-debuginfoUpgrade php-develUpgrade php-json-debuginfoUpgrade php-jsonUpgrade php-cli-debuginfoUpgrade php-opcache-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-xml-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pdo-debuginfoUpgrade php-dba-debuginfoUpgrade php-pdoUpgrade php-intl-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-zip-debugsourceUpgrade libzip-debugsourceUpgrade php-pgsqlUpgrade php-mysqlnd-debuginfoUpgrade php-soapUpgrade php-pecl-apcuUpgrade php-dbgUpgrade libzip-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-common-debuginfoUpgrade php-gmpUpgrade php-common | Mar 12, 2024 | Jul 10, 2019 |
| Suse | — | Upgrade oniguruma-develUpgrade libonig4 | Aug 9, 2024 | Jul 10, 2019 |
| Ubuntu | — | Upgrade php5-fpm (Ubuntu Pro)Upgrade libapache2-mod-php5Upgrade php5-cgi (Ubuntu Pro)Upgrade php5-xmlrpcUpgrade php5-xmlrpc (Ubuntu Pro)Upgrade php5-cgiUpgrade php5-cliUpgrade php5-cli (Ubuntu Pro)Upgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-fpm | Aug 8, 2019 | Jul 10, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub