A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libzipUpgrade php-mbstringUpgrade php-pearUpgrade php-xmlrpcUpgrade php-mysqlndUpgrade php-jsonUpgrade php-pecl-apcuUpgrade php-gmpUpgrade php-pecl-xdebugUpgrade php-develUpgrade onigurumaUpgrade php-cliUpgrade php-fpmUpgrade php-xmlUpgrade php-snmpUpgrade php-pecl-zipUpgrade php-bcmathUpgrade php-commonUpgrade php-pdoUpgrade php-recodeUpgrade php-opcacheUpgrade php-enchantUpgrade php-ldapUpgrade libzip-toolsUpgrade php-dbgUpgrade php-pgsqlUpgrade php-embeddedUpgrade php-pecl-rrdUpgrade phpUpgrade php-intlUpgrade libzip-develUpgrade php-pecl-apcu-develUpgrade php-odbcUpgrade apcu-panelUpgrade php-gdUpgrade php-soapUpgrade oniguruma-develUpgrade php-processUpgrade php-dba | May 4, 2022 | Jul 10, 2019 |
| Alpine Linux | — | Upgrade php7 | Nov 27, 2019 | Jul 10, 2019 |
| Amazon Linux Ami 2 | — | Upgrade oniguruma-develUpgrade oniguruma-debuginfoUpgrade oniguruma | Apr 27, 2020 | Jul 10, 2019 |
| Amazon_linux | — | Upgrade onigurumaUpgrade php73Upgrade php71 | Sep 19, 2019 | Jul 10, 2019 |
| Centos_linux | — | Upgrade php-soapUpgrade php-odbcUpgrade php-dba-debuginfoUpgrade phpUpgrade php-json-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-apcu-develUpgrade php-bcmath-debuginfoUpgrade php-pgsqlUpgrade php-pecl-zip-debuginfoUpgrade php-enchant-debuginfoUpgrade php-bcmathUpgrade php-pecl-xdebug-debugsourceUpgrade php-mbstring-debuginfoUpgrade php-gd-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-ldapUpgrade php-common-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-process-debuginfoUpgrade php-dbaUpgrade apcu-panelUpgrade libzip-debugsourceUpgrade php-soap-debuginfoUpgrade libzip-toolsUpgrade php-intlUpgrade php-fpm-debuginfoUpgrade php-gmp-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pdo-debuginfoUpgrade php-cli-debuginfoUpgrade libzip-debuginfoUpgrade php-commonUpgrade php-dbgUpgrade libzipUpgrade php-opcache-debuginfoUpgrade php-opcacheUpgrade php-pecl-xdebugUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-zipUpgrade libzip-develUpgrade php-snmpUpgrade php-xmlUpgrade php-recodeUpgrade php-pecl-rrd-debuginfoUpgrade php-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-intl-debuginfoUpgrade php-cliUpgrade libzip-tools-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pdoUpgrade php-gmpUpgrade php-mbstringUpgrade php-embedded-debuginfoUpgrade php-fpmUpgrade php-gdUpgrade php-ldap-debuginfoUpgrade php-xmlrpcUpgrade php-snmp-debuginfoUpgrade php-debugsourceUpgrade php-dbg-debuginfoUpgrade php-pearUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-rrdUpgrade php-embeddedUpgrade php-jsonUpgrade php-processUpgrade php-pecl-rrd-debugsourceUpgrade php-enchantUpgrade php-mysqlndUpgrade php-develUpgrade php-recode-debuginfo | Sep 9, 2020 | Jul 10, 2019 |
| Debian | — | Upgrade libonig | Jul 22, 2019 | Jul 10, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade oniguruma | Sep 8, 2019 | Sep 7, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/oniguruma. | Nov 8, 2019 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-pdoUpgrade php-odbcUpgrade php-processUpgrade php-ldapUpgrade php-gdUpgrade php-soapUpgrade php-mysqlUpgrade php-pgsqlUpgrade php-cliUpgrade php-recodeUpgrade phpUpgrade php-xmlUpgrade php-xmlrpcUpgrade php-common | Nov 3, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-odbcUpgrade php-cliUpgrade php-mysqlUpgrade php-xmlUpgrade php-pgsqlUpgrade php-commonUpgrade php-processUpgrade php-ldapUpgrade phpUpgrade php-gdUpgrade php-recodeUpgrade php-xmlrpcUpgrade php-pdoUpgrade php-soap | Sep 28, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Sep 30, 2019 | Jul 10, 2019 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/oniguruma to version 6.9.3-11.4.14.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Jul 10, 2019 |
| Oracle_linux | — | Upgrade php-embeddedUpgrade php-odbcUpgrade php-xmlrpcUpgrade php-pecl-apcu-develUpgrade php-recodeUpgrade php-pearUpgrade php-ldapUpgrade php-commonUpgrade php-jsonUpgrade php-pdoUpgrade php-enchantUpgrade php-cliUpgrade onigurumaUpgrade php-bcmathUpgrade php-pecl-apcuUpgrade php-gmpUpgrade php-pecl-zipUpgrade php-dbgUpgrade php-fpmUpgrade AAVMFUpgrade php-develUpgrade libzipUpgrade php-pecl-xdebugUpgrade php-xmlUpgrade php-opcacheUpgrade php-dbaUpgrade libzip-toolsUpgrade php-soapUpgrade php-pecl-rrdUpgrade apcu-panelUpgrade php-snmpUpgrade php-mbstringUpgrade php-processUpgrade libzip-develUpgrade phpUpgrade php-mysqlndUpgrade php-gdUpgrade oniguruma-develUpgrade php-intlUpgrade OVMFUpgrade php-pgsql | Sep 10, 2020 | Jun 27, 2019 |
| Php | — | Upgrade to PHP version 7.3.9Upgrade to PHP version 7.1.32Upgrade to PHP version 7.2.23 | Sep 15, 2022 | Jul 10, 2019 |
| Redhat_linux | — | Upgrade php-xmlrpc-debuginfoUpgrade php-pgsqlUpgrade php-soapUpgrade php-mbstring-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade oniguruma-debuginfoUpgrade php-dbaUpgrade php-jsonNo solution existsUpgrade php-pecl-xdebug-debugsourceUpgrade php-gdUpgrade php-mbstringUpgrade php-pdoUpgrade libzip-debuginfoUpgrade php-commonUpgrade php-xml-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-xdebugUpgrade php-fpmUpgrade php-opcache-debuginfoUpgrade php-pdo-debuginfoUpgrade php-xmlrpcUpgrade php-bcmathUpgrade php-dba-debuginfoUpgrade php-develUpgrade libzip-tools-debuginfoUpgrade php-pecl-apcu-develUpgrade php-dbg-debuginfoUpgrade php-pecl-zipUpgrade php-pearUpgrade php-gmpUpgrade php-cli-debuginfoUpgrade libzip-debugsourceUpgrade php-pecl-rrdUpgrade php-enchant-debuginfoUpgrade php-odbc-debuginfoUpgrade php-odbcUpgrade php-mysqlnd-debuginfoUpgrade php-processUpgrade php-pecl-apcuUpgrade php-pecl-zip-debugsourceUpgrade php-intl-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-embeddedUpgrade libzip-develUpgrade php-intlUpgrade libzipUpgrade php-dbgUpgrade php-ldap-debuginfoUpgrade php-opcacheUpgrade php-ldapUpgrade php-fpm-debuginfoUpgrade php-gd-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-enchantUpgrade oniguruma-develUpgrade php-pecl-apcu-debuginfoUpgrade php-common-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade oniguruma-debugsourceUpgrade php-pecl-rrd-debugsourceUpgrade php-snmpUpgrade php-xmlUpgrade php-recodeUpgrade php-debuginfoUpgrade phpUpgrade php-debugsourceUpgrade php-cliUpgrade libzip-toolsUpgrade php-bcmath-debuginfoUpgrade php-mysqlndUpgrade php-pecl-apcu-debugsourceUpgrade php-embedded-debuginfoUpgrade php-gmp-debuginfoUpgrade apcu-panelUpgrade php-recode-debuginfoUpgrade onigurumaUpgrade php-process-debuginfoUpgrade php-soap-debuginfoUpgrade php-snmp-debuginfo | Sep 9, 2020 | Jul 10, 2019 |
| Rocky_linux | — | Upgrade php-dbaUpgrade libzip-debuginfoUpgrade php-soapUpgrade php-odbc-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pgsqlUpgrade libzip-debugsourceUpgrade php-dbgUpgrade php-mbstringUpgrade php-mbstring-debuginfoUpgrade php-odbcUpgrade php-pdo-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-xml-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-fpm-debuginfoUpgrade php-intl-debuginfoUpgrade php-dba-debuginfoUpgrade php-json-debuginfoUpgrade php-enchant-debuginfoUpgrade php-jsonUpgrade php-pecl-apcuUpgrade php-develUpgrade libzip-tools-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-opcache-debuginfoUpgrade php-cli-debuginfoUpgrade php-commonUpgrade php-gmpUpgrade php-common-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-fpmUpgrade php-pecl-xdebug-debugsourceUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-ldapUpgrade php-embeddedUpgrade php-embedded-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-intlUpgrade libzip-toolsUpgrade php-recodeUpgrade phpUpgrade php-snmp-debuginfoUpgrade php-dbg-debuginfoUpgrade php-gmp-debuginfoUpgrade php-processUpgrade php-pecl-xdebugUpgrade php-opcacheUpgrade libzip-develUpgrade php-xmlrpcUpgrade php-gdUpgrade php-soap-debuginfoUpgrade php-enchantUpgrade php-xmlUpgrade php-pecl-apcu-debuginfoUpgrade php-debugsourceUpgrade libzipUpgrade php-ldap-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-rrd-debugsourceUpgrade php-snmpUpgrade php-gd-debuginfoUpgrade php-bcmathUpgrade php-cliUpgrade php-recode-debuginfoUpgrade php-pecl-zipUpgrade php-mysqlnd | Mar 12, 2024 | Jul 10, 2019 |
| Suse | — | Upgrade oniguruma-develUpgrade libonig4 | Aug 9, 2024 | Jul 10, 2019 |
| Ubuntu | — | Upgrade libapache2-mod-php5Upgrade php5-fpm (Ubuntu Pro)Upgrade php5-xmlrpcUpgrade php5-xmlrpc (Ubuntu Pro)Upgrade php5-cgi (Ubuntu Pro)Upgrade php5-fpmUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-cgiUpgrade php5-cliUpgrade php5-cli (Ubuntu Pro) | Aug 8, 2019 | Jul 10, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub