A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pearUpgrade php-pecl-apcuUpgrade php-gmpUpgrade php-pdoUpgrade php-pecl-xdebugUpgrade php-mysqlndUpgrade php-pecl-zipUpgrade php-bcmathUpgrade php-snmpUpgrade onigurumaUpgrade php-xmlrpcUpgrade php-fpmUpgrade php-mbstringUpgrade php-commonUpgrade php-cliUpgrade php-recodeUpgrade php-xmlUpgrade php-jsonUpgrade libzipUpgrade php-develUpgrade php-processUpgrade libzip-toolsUpgrade php-enchantUpgrade phpUpgrade php-soapUpgrade php-intlUpgrade php-odbcUpgrade php-opcacheUpgrade php-gdUpgrade php-pecl-rrdUpgrade php-pecl-apcu-develUpgrade php-ldapUpgrade php-pgsqlUpgrade php-embeddedUpgrade php-dbgUpgrade libzip-develUpgrade apcu-panelUpgrade php-dbaUpgrade oniguruma-devel | May 4, 2022 | Jul 10, 2019 |
| Alpine Linux | — | Upgrade php7 | Nov 27, 2019 | Jul 10, 2019 |
| Amazon Linux Ami 2 | — | Upgrade onigurumaUpgrade oniguruma-develUpgrade oniguruma-debuginfo | Apr 27, 2020 | Jul 10, 2019 |
| Amazon_linux | — | Upgrade onigurumaUpgrade php71Upgrade php73 | Sep 19, 2019 | Jul 10, 2019 |
| Centos_linux | — | Upgrade php-recodeUpgrade php-pecl-rrd-debugsourceUpgrade php-opcache-debuginfoUpgrade php-xmlUpgrade php-pecl-rrd-debuginfoUpgrade php-processUpgrade php-embeddedUpgrade php-fpmUpgrade php-dbg-debuginfoUpgrade php-pecl-rrdUpgrade php-xmlrpc-debuginfoUpgrade php-xmlrpcUpgrade php-pearUpgrade php-pecl-xdebugUpgrade php-ldap-debuginfoUpgrade php-pdoUpgrade php-gmpUpgrade php-pecl-apcu-debuginfoUpgrade php-mysqlndUpgrade php-jsonUpgrade php-mysqlnd-debuginfoUpgrade php-gdUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-zipUpgrade php-debuginfoUpgrade libzip-develUpgrade libzip-tools-debuginfoUpgrade php-intl-debuginfoUpgrade php-snmpUpgrade php-recode-debuginfoUpgrade php-snmp-debuginfoUpgrade php-mbstringUpgrade php-opcacheUpgrade php-develUpgrade php-enchantUpgrade php-embedded-debuginfoUpgrade php-debugsourceUpgrade php-cliUpgrade php-json-debuginfoUpgrade php-commonUpgrade php-intlUpgrade php-dbgUpgrade php-mbstring-debuginfoUpgrade apcu-panelUpgrade php-enchant-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-ldapUpgrade libzip-debugsourceUpgrade libzip-toolsUpgrade php-gd-debuginfoUpgrade php-xml-debuginfoUpgrade php-common-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-dbaUpgrade phpUpgrade php-cli-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-apcu-develUpgrade php-bcmathUpgrade php-pecl-xdebug-debugsourceUpgrade libzip-debuginfoUpgrade php-odbcUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-soapUpgrade php-process-debuginfoUpgrade php-dba-debuginfoUpgrade php-pgsqlUpgrade php-pdo-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-fpm-debuginfoUpgrade php-gmp-debuginfoUpgrade php-soap-debuginfoUpgrade libzipUpgrade php-odbc-debuginfo | Sep 9, 2020 | Jul 10, 2019 |
| Debian | — | Upgrade libonig | Jul 22, 2019 | Jul 10, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade oniguruma | Sep 8, 2019 | Sep 7, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/oniguruma. | Nov 8, 2019 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-xmlrpcUpgrade php-recodeUpgrade php-cliUpgrade php-commonUpgrade phpUpgrade php-xmlUpgrade php-gdUpgrade php-pdoUpgrade php-ldapUpgrade php-mysqlUpgrade php-processUpgrade php-soapUpgrade php-pgsqlUpgrade php-odbc | Nov 3, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-commonUpgrade php-xmlUpgrade php-pgsqlUpgrade php-odbcUpgrade php-cliUpgrade php-mysqlUpgrade php-pdoUpgrade php-ldapUpgrade php-soapUpgrade php-processUpgrade phpUpgrade php-recodeUpgrade php-gdUpgrade php-xmlrpc | Sep 28, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Sep 30, 2019 | Jul 10, 2019 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/oniguruma to version 6.9.3-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Jul 10, 2019 |
| Oracle_linux | — | Upgrade php-mbstringUpgrade php-pgsqlUpgrade php-soapUpgrade libzip-toolsUpgrade OVMFUpgrade php-mysqlndUpgrade php-pecl-rrdUpgrade php-processUpgrade oniguruma-develUpgrade php-snmpUpgrade libzip-develUpgrade phpUpgrade php-intlUpgrade apcu-panelUpgrade php-dbaUpgrade php-gdUpgrade php-opcacheUpgrade php-jsonUpgrade php-pecl-xdebugUpgrade php-dbgUpgrade php-bcmathUpgrade php-enchantUpgrade php-ldapUpgrade php-develUpgrade php-cliUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-pecl-apcu-develUpgrade php-gmpUpgrade php-odbcUpgrade php-pearUpgrade php-pecl-zipUpgrade libzipUpgrade php-pecl-apcuUpgrade php-fpmUpgrade php-embeddedUpgrade php-xmlUpgrade php-pdoUpgrade php-commonUpgrade onigurumaUpgrade AAVMF | Sep 10, 2020 | Jun 27, 2019 |
| Php | — | Upgrade to PHP version 7.2.23Upgrade to PHP version 7.1.32Upgrade to PHP version 7.3.9 | Sep 15, 2022 | Jul 10, 2019 |
| Redhat_linux | — | Upgrade libzip-debuginfoUpgrade php-fpmUpgrade php-gmpUpgrade php-pdo-debuginfoUpgrade php-intl-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-apcuUpgrade php-opcache-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-enchant-debuginfoUpgrade php-dba-debuginfoUpgrade php-soapUpgrade libzip-debugsourceUpgrade php-mbstringUpgrade php-pecl-rrdUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pecl-xdebugUpgrade php-commonUpgrade php-pearUpgrade php-pdoUpgrade php-gdUpgrade oniguruma-debuginfoUpgrade php-cli-debuginfoUpgrade php-processUpgrade php-xmlrpcUpgrade php-dbg-debuginfoUpgrade php-pgsqlUpgrade php-pecl-zip-debugsourceUpgrade php-jsonUpgrade php-xml-debuginfoUpgrade php-develUpgrade php-mbstring-debuginfoUpgrade php-pecl-zipUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-rrd-debuginfoNo solution existsUpgrade php-odbc-debuginfoUpgrade php-dbaUpgrade php-bcmathUpgrade php-odbcUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-xmlUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-ldapUpgrade onigurumaUpgrade libzip-develUpgrade php-ldap-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-snmp-debuginfoUpgrade php-snmpUpgrade php-soap-debuginfoUpgrade php-gd-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pgsql-debuginfoUpgrade libzipUpgrade oniguruma-debugsourceUpgrade oniguruma-develUpgrade phpUpgrade php-process-debuginfoUpgrade php-common-debuginfoUpgrade php-opcacheUpgrade php-gmp-debuginfoUpgrade php-dbgUpgrade php-recode-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-embedded-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-mysqlndUpgrade libzip-toolsUpgrade php-recodeUpgrade php-debuginfoUpgrade php-embeddedUpgrade php-intlUpgrade php-debugsourceUpgrade php-cliUpgrade apcu-panelUpgrade php-enchant | Sep 9, 2020 | Jul 10, 2019 |
| Rocky_linux | — | Upgrade php-bcmathUpgrade php-gd-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade libzip-toolsUpgrade php-pgsql-debuginfoUpgrade php-intlUpgrade php-pecl-zipUpgrade php-cliUpgrade php-snmpUpgrade php-xmlUpgrade php-embeddedUpgrade php-pecl-apcu-debuginfoUpgrade php-gdUpgrade php-opcacheUpgrade libzipUpgrade php-debugsourceUpgrade php-pecl-rrdUpgrade php-recode-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pecl-xdebugUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-gmp-debuginfoUpgrade phpUpgrade php-enchantUpgrade php-processUpgrade php-ldapUpgrade php-snmp-debuginfoUpgrade php-soap-debuginfoUpgrade php-dbg-debuginfoUpgrade php-ldap-debuginfoUpgrade php-mysqlndUpgrade php-embedded-debuginfoUpgrade libzip-develUpgrade php-commonUpgrade php-soapUpgrade php-odbcUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-gmpUpgrade php-common-debuginfoUpgrade libzip-debugsourceUpgrade php-pecl-apcuUpgrade php-jsonUpgrade php-mysqlnd-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-pgsqlUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-apcu-develUpgrade php-dba-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pdoUpgrade php-intl-debuginfoUpgrade php-fpm-debuginfoUpgrade php-xml-debuginfoUpgrade php-opcache-debuginfoUpgrade php-odbc-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-dbaUpgrade php-dbgUpgrade php-process-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-fpmUpgrade php-debuginfoUpgrade php-develUpgrade php-cli-debuginfoUpgrade php-enchant-debuginfoUpgrade php-json-debuginfoUpgrade php-mbstring | Mar 12, 2024 | Jul 10, 2019 |
| Suse | — | Upgrade libonig4Upgrade oniguruma-devel | Aug 9, 2024 | Jul 10, 2019 |
| Ubuntu | — | Upgrade php5-xmlrpcUpgrade php5-cgi (Ubuntu Pro)Upgrade php5-fpm (Ubuntu Pro)Upgrade php5-xmlrpc (Ubuntu Pro)Upgrade libapache2-mod-php5Upgrade php5-cli (Ubuntu Pro)Upgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-cliUpgrade php5-cgiUpgrade php5-fpm | Aug 8, 2019 | Jul 10, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub