A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-gmpUpgrade php-commonUpgrade php-xmlrpcUpgrade php-mysqlndUpgrade php-pdoUpgrade php-pecl-apcuUpgrade php-snmpUpgrade php-cliUpgrade php-jsonUpgrade php-develUpgrade libzipUpgrade php-fpmUpgrade php-pecl-xdebugUpgrade php-pecl-zipUpgrade onigurumaUpgrade php-mbstringUpgrade php-xmlUpgrade php-bcmathUpgrade php-recodeUpgrade php-pearUpgrade libzip-develUpgrade php-ldapUpgrade php-dbaUpgrade phpUpgrade php-soapUpgrade php-processUpgrade php-gdUpgrade php-pgsqlUpgrade php-pecl-apcu-develUpgrade php-enchantUpgrade php-embeddedUpgrade php-intlUpgrade php-dbgUpgrade php-opcacheUpgrade php-pecl-rrdUpgrade apcu-panelUpgrade libzip-toolsUpgrade php-odbcUpgrade oniguruma-devel | May 4, 2022 | Jul 10, 2019 |
| Alpine Linux | — | Upgrade php7 | Nov 27, 2019 | Jul 10, 2019 |
| Amazon Linux Ami 2 | — | Upgrade oniguruma-debuginfoUpgrade oniguruma-develUpgrade oniguruma | Apr 27, 2020 | Jul 10, 2019 |
| Amazon_linux | — | Upgrade php71Upgrade php73Upgrade oniguruma | Sep 19, 2019 | Jul 10, 2019 |
| Centos_linux | — | Upgrade php-gmpUpgrade php-mysqlndUpgrade php-enchantUpgrade php-mysqlnd-debuginfoUpgrade php-xmlUpgrade php-embedded-debuginfoUpgrade php-recode-debuginfoUpgrade php-intl-debuginfoUpgrade php-debugsourceUpgrade php-opcache-debuginfoUpgrade php-develUpgrade php-xmlrpc-debuginfoUpgrade libzip-develUpgrade php-pecl-zipUpgrade php-pecl-rrd-debugsourceUpgrade php-pearUpgrade php-mbstringUpgrade php-jsonUpgrade php-opcacheUpgrade php-snmpUpgrade php-ldap-debuginfoUpgrade php-dbg-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-xmlrpcUpgrade php-pecl-rrd-debuginfoUpgrade php-pdoUpgrade php-pecl-zip-debugsourceUpgrade php-processUpgrade php-pecl-apcu-debuginfoUpgrade php-gdUpgrade php-snmp-debuginfoUpgrade php-pecl-xdebugUpgrade php-cliUpgrade php-fpmUpgrade php-embeddedUpgrade php-pecl-rrdUpgrade php-debuginfoUpgrade php-recodeUpgrade php-process-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-soapUpgrade php-odbc-debuginfoUpgrade php-dbgUpgrade php-pecl-zip-debuginfoUpgrade php-pgsqlUpgrade php-pecl-xdebug-debuginfoUpgrade apcu-panelUpgrade libzip-toolsUpgrade php-dba-debuginfoUpgrade php-odbcUpgrade php-dbaUpgrade phpUpgrade php-pdo-debuginfoUpgrade php-intlUpgrade php-xml-debuginfoUpgrade php-common-debuginfoUpgrade php-gmp-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-fpm-debuginfoUpgrade php-soap-debuginfoUpgrade php-ldapUpgrade php-pecl-apcu-debugsourceUpgrade php-enchant-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-gd-debuginfoUpgrade php-bcmathUpgrade php-commonUpgrade libzip-debuginfoUpgrade php-cli-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-apcu-develUpgrade php-pecl-apcuUpgrade libzip-debugsourceUpgrade libzip | Sep 9, 2020 | Jul 10, 2019 |
| Debian | — | Upgrade libonig | Jul 22, 2019 | Jul 10, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade oniguruma | Sep 8, 2019 | Sep 7, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/oniguruma. | Nov 8, 2019 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-odbcUpgrade php-gdUpgrade php-soapUpgrade php-processUpgrade php-pdoUpgrade php-ldapUpgrade php-pgsqlUpgrade php-mysqlUpgrade phpUpgrade php-cliUpgrade php-xmlUpgrade php-recodeUpgrade php-xmlrpcUpgrade php-common | Nov 3, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-cliUpgrade php-xmlUpgrade php-mysqlUpgrade php-pgsqlUpgrade php-odbcUpgrade php-commonUpgrade php-soapUpgrade php-recodeUpgrade phpUpgrade php-xmlrpcUpgrade php-processUpgrade php-ldapUpgrade php-pdoUpgrade php-gd | Sep 28, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Sep 30, 2019 | Jul 10, 2019 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/oniguruma to version 6.9.3-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Jul 10, 2019 |
| Oracle_linux | — | Upgrade php-xmlUpgrade php-embeddedUpgrade php-pecl-zipUpgrade php-odbcUpgrade php-fpmUpgrade php-enchantUpgrade php-pearUpgrade libzipUpgrade php-recodeUpgrade php-ldapUpgrade php-cliUpgrade php-bcmathUpgrade php-pecl-apcu-develUpgrade php-gmpUpgrade php-xmlrpcUpgrade AAVMFUpgrade php-dbgUpgrade php-pecl-xdebugUpgrade php-pecl-apcuUpgrade php-develUpgrade php-pdoUpgrade onigurumaUpgrade php-commonUpgrade php-jsonUpgrade oniguruma-develUpgrade php-intlUpgrade php-pecl-rrdUpgrade php-pgsqlUpgrade php-opcacheUpgrade php-mysqlndUpgrade OVMFUpgrade php-soapUpgrade apcu-panelUpgrade php-snmpUpgrade php-mbstringUpgrade php-gdUpgrade php-dbaUpgrade php-processUpgrade libzip-develUpgrade libzip-toolsUpgrade php | Sep 10, 2020 | Jun 27, 2019 |
| Php | — | Upgrade to PHP version 7.3.9Upgrade to PHP version 7.1.32Upgrade to PHP version 7.2.23 | Sep 15, 2022 | Jul 10, 2019 |
| Redhat_linux | — | Upgrade php-dbg-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-rrdUpgrade php-cli-debuginfoUpgrade php-fpmUpgrade php-pdo-debuginfoNo solution existsUpgrade php-gmpUpgrade php-pecl-apcu-develUpgrade php-pecl-xdebugUpgrade php-mbstring-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-zipUpgrade php-pecl-xdebug-debuginfoUpgrade php-jsonUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-intl-debuginfoUpgrade php-opcache-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-mbstringUpgrade php-develUpgrade php-dba-debuginfoUpgrade php-xmlrpcUpgrade php-pdoUpgrade php-odbc-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-rrd-debuginfoUpgrade php-bcmathUpgrade php-json-debuginfoUpgrade php-pgsqlUpgrade php-soapUpgrade php-pearUpgrade php-processUpgrade php-commonUpgrade php-gdUpgrade libzip-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade oniguruma-debuginfoUpgrade php-odbcUpgrade libzip-debugsourceUpgrade php-dbaUpgrade php-recode-debuginfoUpgrade php-dbgUpgrade php-xmlUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-intlUpgrade php-common-debuginfoUpgrade oniguruma-debugsourceUpgrade php-soap-debuginfoUpgrade php-snmpUpgrade php-pecl-apcu-debugsourceUpgrade php-debugsourceUpgrade libzip-toolsUpgrade php-bcmath-debuginfoUpgrade php-embeddedUpgrade php-enchantUpgrade onigurumaUpgrade php-gmp-debuginfoUpgrade php-embedded-debuginfoUpgrade php-fpm-debuginfoUpgrade libzip-develUpgrade php-mysqlndUpgrade php-recodeUpgrade php-pgsql-debuginfoUpgrade apcu-panelUpgrade php-opcacheUpgrade php-cliUpgrade libzipUpgrade php-ldapUpgrade php-gd-debuginfoUpgrade php-ldap-debuginfoUpgrade php-process-debuginfoUpgrade php-snmp-debuginfoUpgrade oniguruma-develUpgrade php | Sep 9, 2020 | Jul 10, 2019 |
| Rocky_linux | — | Upgrade php-embedded-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-embeddedUpgrade php-recode-debuginfoUpgrade libzipUpgrade libzip-develUpgrade php-pecl-xdebugUpgrade php-pecl-zipUpgrade php-xmlUpgrade php-intlUpgrade php-pecl-apcu-debuginfoUpgrade libzip-toolsUpgrade php-debugsourceUpgrade php-opcacheUpgrade php-bcmathUpgrade php-pecl-rrd-debugsourceUpgrade php-mysqlndUpgrade php-snmpUpgrade php-gdUpgrade php-xmlrpcUpgrade php-cliUpgrade php-gd-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-rrdUpgrade php-soap-debuginfoUpgrade php-recodeUpgrade php-gmp-debuginfoUpgrade php-enchantUpgrade php-snmp-debuginfoUpgrade php-ldap-debuginfoUpgrade phpUpgrade php-dbg-debuginfoUpgrade php-processUpgrade php-ldapUpgrade php-pdoUpgrade php-pecl-apcu-develUpgrade php-pdo-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcuUpgrade php-mysqlnd-debuginfoUpgrade php-opcache-debuginfoUpgrade php-fpm-debuginfoUpgrade php-intl-debuginfoUpgrade php-dba-debuginfoUpgrade php-xml-debuginfoUpgrade php-cli-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-json-debuginfoUpgrade php-jsonUpgrade php-develUpgrade php-enchant-debuginfoUpgrade php-pgsqlUpgrade php-gmpUpgrade php-common-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade libzip-debugsourceUpgrade php-commonUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-odbc-debuginfoUpgrade libzip-debuginfoUpgrade php-debuginfoUpgrade php-process-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-fpmUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-dbgUpgrade php-dbaUpgrade php-mbstring-debuginfoUpgrade php-mbstringUpgrade php-odbcUpgrade php-soap | Mar 12, 2024 | Jul 10, 2019 |
| Suse | — | Upgrade oniguruma-develUpgrade libonig4 | Aug 9, 2024 | Jul 10, 2019 |
| Ubuntu | — | Upgrade php5-xmlrpcUpgrade libapache2-mod-php5Upgrade php5-cgi (Ubuntu Pro)Upgrade php5-fpm (Ubuntu Pro)Upgrade php5-xmlrpc (Ubuntu Pro)Upgrade php5-cgiUpgrade php5-cliUpgrade php5-cli (Ubuntu Pro)Upgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-fpm | Aug 8, 2019 | Jul 10, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub