A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pecl-xdebugUpgrade libzipUpgrade php-pecl-zipUpgrade php-gmpUpgrade php-xmlUpgrade php-jsonUpgrade php-snmpUpgrade php-recodeUpgrade php-develUpgrade php-xmlrpcUpgrade php-pecl-apcuUpgrade php-pearUpgrade php-mysqlndUpgrade php-cliUpgrade php-commonUpgrade php-bcmathUpgrade php-pdoUpgrade php-fpmUpgrade onigurumaUpgrade php-mbstringUpgrade php-odbcUpgrade php-soapUpgrade php-embeddedUpgrade libzip-develUpgrade oniguruma-develUpgrade libzip-toolsUpgrade php-ldapUpgrade php-gdUpgrade php-opcacheUpgrade phpUpgrade php-pecl-rrdUpgrade php-dbgUpgrade apcu-panelUpgrade php-dbaUpgrade php-processUpgrade php-pgsqlUpgrade php-pecl-apcu-develUpgrade php-enchantUpgrade php-intl | May 4, 2022 | Jul 10, 2019 |
| Alpine Linux | — | Upgrade php7 | Nov 27, 2019 | Jul 10, 2019 |
| Amazon Linux Ami 2 | — | Upgrade oniguruma-debuginfoUpgrade oniguruma-develUpgrade oniguruma | Apr 27, 2020 | Jul 10, 2019 |
| Amazon_linux | — | Upgrade onigurumaUpgrade php73Upgrade php71 | Sep 19, 2019 | Jul 10, 2019 |
| Centos_linux | — | Upgrade php-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-dbgUpgrade php-pecl-zip-debugsourceUpgrade php-processUpgrade php-intl-debuginfoUpgrade php-enchantUpgrade php-pearUpgrade php-xmlrpcUpgrade php-gmpUpgrade php-gdUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-zipUpgrade php-pecl-apcu-debuginfoUpgrade php-pdoUpgrade php-bcmath-debuginfoUpgrade php-cli-debuginfoUpgrade php-pecl-rrdUpgrade php-ldapUpgrade php-snmpUpgrade php-opcacheUpgrade php-pecl-rrd-debuginfoUpgrade php-snmp-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-opcache-debuginfoUpgrade php-xmlUpgrade php-recode-debuginfoUpgrade php-jsonUpgrade php-pecl-xdebug-debugsourceUpgrade php-pdo-debuginfoUpgrade apcu-panelUpgrade php-embeddedUpgrade php-ldap-debuginfoUpgrade php-debuginfoUpgrade php-mbstringUpgrade php-recodeUpgrade php-develUpgrade php-embedded-debuginfoUpgrade php-mysqlndUpgrade php-mysqlnd-debuginfoUpgrade libzip-develUpgrade php-fpmUpgrade php-dbg-debuginfoUpgrade php-pecl-xdebugUpgrade php-bcmathUpgrade php-cliUpgrade php-gmp-debuginfoUpgrade php-fpm-debuginfoUpgrade php-soap-debuginfoUpgrade php-xml-debuginfoUpgrade php-common-debuginfoUpgrade libzipUpgrade php-dbaUpgrade php-process-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-enchant-debuginfoUpgrade php-gd-debuginfoUpgrade php-soapUpgrade phpUpgrade php-json-debuginfoUpgrade php-commonUpgrade libzip-debuginfoUpgrade libzip-toolsUpgrade php-odbc-debuginfoUpgrade libzip-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-apcu-develUpgrade php-pecl-apcu-debugsourceUpgrade php-pgsqlUpgrade php-pgsql-debuginfoUpgrade php-dba-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-intlUpgrade php-odbc | Sep 9, 2020 | Jul 10, 2019 |
| Debian | — | Upgrade libonig | Jul 22, 2019 | Jul 10, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade oniguruma | Sep 8, 2019 | Sep 7, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/oniguruma. | Nov 8, 2019 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade phpUpgrade php-xmlUpgrade php-commonUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-cliUpgrade php-pdoUpgrade php-odbcUpgrade php-gdUpgrade php-ldapUpgrade php-soapUpgrade php-pgsqlUpgrade php-processUpgrade php-mysql | Nov 3, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-xmlUpgrade phpUpgrade php-gdUpgrade php-soapUpgrade php-recodeUpgrade php-processUpgrade php-xmlrpcUpgrade php-ldapUpgrade php-pdoUpgrade php-cliUpgrade php-mysqlUpgrade php-pgsqlUpgrade php-commonUpgrade php-odbc | Sep 28, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Sep 30, 2019 | Jul 10, 2019 |
| Oracle Solaris | — | Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/oniguruma to version 6.9.3-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Jul 10, 2019 |
| Oracle_linux | — | Upgrade php-xmlUpgrade php-pecl-apcuUpgrade php-enchantUpgrade php-gmpUpgrade php-dbgUpgrade php-cliUpgrade php-ldapUpgrade php-pecl-zipUpgrade php-odbcUpgrade php-commonUpgrade php-develUpgrade php-jsonUpgrade onigurumaUpgrade php-bcmathUpgrade AAVMFUpgrade php-recodeUpgrade php-pdoUpgrade php-pecl-xdebugUpgrade php-xmlrpcUpgrade php-pecl-apcu-develUpgrade libzipUpgrade php-embeddedUpgrade php-pearUpgrade php-fpmUpgrade phpUpgrade libzip-toolsUpgrade php-pgsqlUpgrade php-pecl-rrdUpgrade oniguruma-develUpgrade php-intlUpgrade php-soapUpgrade OVMFUpgrade php-processUpgrade libzip-develUpgrade php-dbaUpgrade php-opcacheUpgrade php-mysqlndUpgrade php-gdUpgrade php-mbstringUpgrade apcu-panelUpgrade php-snmp | Sep 10, 2020 | Jun 27, 2019 |
| Php | — | Upgrade to PHP version 7.3.9Upgrade to PHP version 7.1.32Upgrade to PHP version 7.2.23 | Sep 15, 2022 | Jul 10, 2019 |
| Redhat_linux | — | Upgrade php-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-common-debuginfoUpgrade php-soap-debuginfoUpgrade php-ldap-debuginfoUpgrade php-snmpUpgrade php-opcacheUpgrade php-embeddedUpgrade php-pgsql-debuginfoUpgrade apcu-panelUpgrade php-gd-debuginfoUpgrade php-xmlUpgrade php-dbgUpgrade onigurumaUpgrade php-embedded-debuginfoUpgrade libzip-develUpgrade php-ldapUpgrade libzip-toolsUpgrade oniguruma-develUpgrade php-pecl-zip-debuginfoUpgrade phpUpgrade php-pecl-rrd-debugsourceUpgrade php-process-debuginfoUpgrade php-intlUpgrade php-recode-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-recodeUpgrade php-snmp-debuginfoUpgrade php-fpm-debuginfoUpgrade php-debugsourceUpgrade php-cliUpgrade php-gmp-debuginfoUpgrade php-mysqlndUpgrade php-pecl-apcu-debugsourceUpgrade oniguruma-debugsourceUpgrade libzipUpgrade php-enchantUpgrade php-commonUpgrade php-pearUpgrade php-processUpgrade php-pecl-zipUpgrade php-intl-debuginfoUpgrade php-jsonUpgrade php-pecl-rrdUpgrade php-soapUpgrade php-pecl-apcu-develUpgrade php-odbcNo solution existsUpgrade php-xml-debuginfoUpgrade oniguruma-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-fpmUpgrade php-pecl-apcuUpgrade php-json-debuginfoUpgrade php-gmpUpgrade php-enchant-debuginfoUpgrade libzip-debuginfoUpgrade php-pgsqlUpgrade php-pdoUpgrade php-pecl-zip-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-odbc-debuginfoUpgrade php-dbg-debuginfoUpgrade php-mbstringUpgrade php-dbaUpgrade php-pecl-xdebug-debugsourceUpgrade php-bcmathUpgrade php-cli-debuginfoUpgrade php-opcache-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade libzip-debugsourceUpgrade php-pecl-xdebugUpgrade php-pdo-debuginfoUpgrade php-gdUpgrade php-dba-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-develUpgrade libzip-tools-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-xmlrpc | Sep 9, 2020 | Jul 10, 2019 |
| Rocky_linux | — | Upgrade php-gd-debuginfoUpgrade php-embeddedUpgrade php-gdUpgrade php-snmpUpgrade php-pecl-rrdUpgrade php-xmlrpcUpgrade php-soap-debuginfoUpgrade php-processUpgrade php-bcmath-debuginfoUpgrade php-bcmathUpgrade php-embedded-debuginfoUpgrade php-recode-debuginfoUpgrade php-mysqlndUpgrade php-ldapUpgrade php-enchantUpgrade php-cliUpgrade php-snmp-debuginfoUpgrade phpUpgrade php-dbg-debuginfoUpgrade php-xmlUpgrade libzipUpgrade php-pecl-apcu-debuginfoUpgrade php-debugsourceUpgrade php-pgsql-debuginfoUpgrade php-intlUpgrade php-pecl-zipUpgrade php-pecl-xdebugUpgrade libzip-develUpgrade php-recodeUpgrade php-opcacheUpgrade php-pecl-rrd-debugsourceUpgrade php-ldap-debuginfoUpgrade libzip-toolsUpgrade php-gmp-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-xmlrpc-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-cli-debuginfoUpgrade php-gmpUpgrade php-commonUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcuUpgrade php-pecl-xdebug-debugsourceUpgrade php-mbstringUpgrade php-process-debuginfoUpgrade php-debuginfoUpgrade php-soapUpgrade php-pecl-apcu-develUpgrade php-opcache-debuginfoUpgrade php-dba-debuginfoUpgrade php-xml-debuginfoUpgrade php-intl-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pdoUpgrade php-fpm-debuginfoUpgrade php-fpmUpgrade libzip-debugsourceUpgrade php-common-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-enchant-debuginfoUpgrade php-json-debuginfoUpgrade php-jsonUpgrade php-develUpgrade php-pecl-rrd-debuginfoUpgrade php-pgsqlUpgrade php-odbc-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-dbaUpgrade php-pecl-zip-debuginfoUpgrade php-odbcUpgrade php-mbstring-debuginfoUpgrade php-dbg | Mar 12, 2024 | Jul 10, 2019 |
| Suse | — | Upgrade libonig4Upgrade oniguruma-devel | Aug 9, 2024 | Jul 10, 2019 |
| Ubuntu | — | Upgrade php5-xmlrpcUpgrade php5-cgi (Ubuntu Pro)Upgrade libapache2-mod-php5Upgrade php5-fpm (Ubuntu Pro)Upgrade php5-xmlrpc (Ubuntu Pro)Upgrade php5-cliUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-cgiUpgrade php5-cli (Ubuntu Pro)Upgrade php5-fpm | Aug 8, 2019 | Jul 10, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub