A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-mysqlndUpgrade php-commonUpgrade php-mbstringUpgrade php-pdoUpgrade php-recodeUpgrade php-pecl-apcuUpgrade php-snmpUpgrade php-xmlrpcUpgrade php-pearUpgrade php-bcmathUpgrade php-develUpgrade php-pecl-xdebugUpgrade php-cliUpgrade libzipUpgrade onigurumaUpgrade php-fpmUpgrade php-pecl-zipUpgrade php-xmlUpgrade php-gmpUpgrade php-jsonUpgrade php-opcacheUpgrade php-ldapUpgrade libzip-toolsUpgrade libzip-develUpgrade php-pgsqlUpgrade php-embeddedUpgrade php-pecl-rrdUpgrade php-soapUpgrade php-enchantUpgrade php-dbgUpgrade php-processUpgrade apcu-panelUpgrade php-gdUpgrade oniguruma-develUpgrade php-dbaUpgrade php-pecl-apcu-develUpgrade php-intlUpgrade phpUpgrade php-odbc | May 4, 2022 | Jul 10, 2019 |
| Alpine Linux | — | Upgrade php7 | Nov 27, 2019 | Jul 10, 2019 |
| Amazon Linux Ami 2 | — | Upgrade oniguruma-develUpgrade oniguruma-debuginfoUpgrade oniguruma | Apr 27, 2020 | Jul 10, 2019 |
| Amazon_linux | — | Upgrade onigurumaUpgrade php73Upgrade php71 | Sep 19, 2019 | Jul 10, 2019 |
| Centos_linux | — | Upgrade php-odbc-debuginfoUpgrade php-odbcUpgrade libzipUpgrade php-pecl-zip-debuginfoUpgrade php-commonUpgrade php-dba-debuginfoUpgrade php-pgsqlUpgrade libzip-debuginfoUpgrade libzip-debugsourceUpgrade php-dbgUpgrade php-pecl-xdebug-debugsourceUpgrade php-pgsql-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-apcu-develUpgrade apcu-panelUpgrade libzip-toolsUpgrade php-cli-debuginfoUpgrade php-soap-debuginfoUpgrade php-bcmathUpgrade php-gmp-debuginfoUpgrade php-intlUpgrade php-pdo-debuginfoUpgrade php-pecl-apcuUpgrade php-ldapUpgrade php-soapUpgrade php-mbstring-debuginfoUpgrade php-xml-debuginfoUpgrade php-process-debuginfoUpgrade php-gd-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-common-debuginfoUpgrade php-dbaUpgrade phpUpgrade php-bcmath-debuginfoUpgrade php-enchant-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-opcacheUpgrade php-dbg-debuginfoUpgrade php-snmpUpgrade php-debuginfoUpgrade php-cliUpgrade php-xmlrpc-debuginfoUpgrade php-xmlUpgrade php-snmp-debuginfoUpgrade php-intl-debuginfoUpgrade php-debugsourceUpgrade php-processUpgrade php-recodeUpgrade php-pecl-rrd-debuginfoUpgrade php-xmlrpcUpgrade libzip-develUpgrade libzip-tools-debuginfoUpgrade php-develUpgrade php-jsonUpgrade php-mbstringUpgrade php-gmpUpgrade php-embedded-debuginfoUpgrade php-mysqlndUpgrade php-pecl-zipUpgrade php-enchantUpgrade php-pearUpgrade php-pdoUpgrade php-ldap-debuginfoUpgrade php-opcache-debuginfoUpgrade php-gdUpgrade php-pecl-apcu-debuginfoUpgrade php-recode-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-xdebugUpgrade php-fpmUpgrade php-embedded | Sep 9, 2020 | Jul 10, 2019 |
| Debian | — | Upgrade libonig | Jul 22, 2019 | Jul 10, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade oniguruma | Sep 8, 2019 | Sep 7, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/oniguruma. | Nov 8, 2019 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-gdUpgrade php-soapUpgrade php-mysqlUpgrade php-ldapUpgrade php-odbcUpgrade php-pgsqlUpgrade php-pdoUpgrade php-processUpgrade php-recodeUpgrade php-xmlrpcUpgrade phpUpgrade php-commonUpgrade php-xmlUpgrade php-cli | Nov 3, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-recodeUpgrade phpUpgrade php-soapUpgrade php-processUpgrade php-xmlrpcUpgrade php-ldapUpgrade php-gdUpgrade php-pdoUpgrade php-pgsqlUpgrade php-odbcUpgrade php-commonUpgrade php-mysqlUpgrade php-xmlUpgrade php-cli | Sep 28, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Sep 30, 2019 | Jul 10, 2019 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/oniguruma to version 6.9.3-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Jul 10, 2019 |
| Oracle_linux | — | Upgrade libzip-toolsUpgrade php-soapUpgrade php-opcacheUpgrade apcu-panelUpgrade php-intlUpgrade php-pgsqlUpgrade php-mbstringUpgrade OVMFUpgrade oniguruma-develUpgrade libzip-develUpgrade php-pecl-rrdUpgrade php-processUpgrade phpUpgrade php-dbaUpgrade php-gdUpgrade php-mysqlndUpgrade php-snmpUpgrade php-odbcUpgrade php-pecl-apcuUpgrade php-pecl-zipUpgrade php-pearUpgrade php-pecl-apcu-develUpgrade php-xmlrpcUpgrade php-enchantUpgrade php-gmpUpgrade php-cliUpgrade php-recodeUpgrade php-xmlUpgrade libzipUpgrade php-embeddedUpgrade php-fpmUpgrade php-develUpgrade php-bcmathUpgrade onigurumaUpgrade php-pdoUpgrade php-ldapUpgrade AAVMFUpgrade php-pecl-xdebugUpgrade php-jsonUpgrade php-dbgUpgrade php-common | Sep 10, 2020 | Jun 27, 2019 |
| Php | — | Upgrade to PHP version 7.3.9Upgrade to PHP version 7.1.32Upgrade to PHP version 7.2.23 | Sep 15, 2022 | Jul 10, 2019 |
| Redhat_linux | — | Upgrade oniguruma-develUpgrade php-ldapUpgrade php-embeddedUpgrade libzipUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-snmpUpgrade php-xmlUpgrade php-bcmath-debuginfoUpgrade phpUpgrade libzip-toolsUpgrade php-process-debuginfoUpgrade php-cliUpgrade php-debugsourceUpgrade libzip-develUpgrade php-dbgUpgrade php-pecl-apcu-debugsourceUpgrade php-debuginfoUpgrade php-intlUpgrade php-pecl-zip-debuginfoUpgrade php-snmp-debuginfoUpgrade php-recode-debuginfoUpgrade php-ldap-debuginfoUpgrade php-gmp-debuginfoUpgrade php-common-debuginfoUpgrade php-recodeUpgrade php-embedded-debuginfoUpgrade php-soap-debuginfoUpgrade php-pgsql-debuginfoUpgrade apcu-panelUpgrade php-mysqlndUpgrade php-fpm-debuginfoUpgrade oniguruma-debugsourceUpgrade php-enchantUpgrade php-gd-debuginfoUpgrade onigurumaUpgrade php-opcacheUpgrade php-mbstring-debuginfoUpgrade php-pdoUpgrade php-pecl-zip-debugsourceUpgrade php-pgsqlUpgrade php-fpmUpgrade php-odbc-debuginfoUpgrade php-pearUpgrade php-odbcUpgrade php-soapUpgrade libzip-debuginfoUpgrade php-processUpgrade php-mysqlnd-debuginfoUpgrade oniguruma-debuginfoUpgrade libzip-debugsourceUpgrade php-commonUpgrade php-mbstringUpgrade php-jsonUpgrade php-develUpgrade libzip-tools-debuginfoUpgrade php-pecl-apcu-develUpgrade php-gmpUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-xdebugUpgrade php-cli-debuginfoUpgrade php-xmlrpcUpgrade php-intl-debuginfoUpgrade php-dba-debuginfoUpgrade php-dbaUpgrade php-enchant-debuginfoUpgrade php-gdUpgrade php-bcmathUpgrade php-xmlrpc-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-dbg-debuginfoNo solution existsUpgrade php-opcache-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-zipUpgrade php-json-debuginfoUpgrade php-pecl-apcu | Sep 9, 2020 | Jul 10, 2019 |
| Rocky_linux | — | Upgrade php-process-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-fpmUpgrade php-xmlrpc-debuginfoUpgrade php-gmpUpgrade php-commonUpgrade php-pecl-apcu-debugsourceUpgrade php-common-debuginfoUpgrade php-debuginfoUpgrade php-dbgUpgrade php-mbstringUpgrade php-pecl-apcuUpgrade php-mbstring-debuginfoUpgrade php-odbcUpgrade php-pecl-zip-debuginfoUpgrade php-soapUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade libzip-debuginfoUpgrade php-odbc-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pgsqlUpgrade php-pecl-rrd-debuginfoUpgrade libzip-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-develUpgrade php-pdo-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-xml-debuginfoUpgrade php-dbaUpgrade php-pecl-xdebug-debuginfoUpgrade php-opcache-debuginfoUpgrade php-dba-debuginfoUpgrade php-cli-debuginfoUpgrade php-jsonUpgrade php-json-debuginfoUpgrade php-fpm-debuginfoUpgrade php-intl-debuginfoUpgrade php-processUpgrade php-pgsql-debuginfoUpgrade php-pecl-zipUpgrade phpUpgrade php-dbg-debuginfoUpgrade php-recodeUpgrade php-snmp-debuginfoUpgrade php-gmp-debuginfoUpgrade php-ldapUpgrade libzip-develUpgrade php-intlUpgrade libzip-toolsUpgrade php-mysqlndUpgrade php-embedded-debuginfoUpgrade php-cliUpgrade php-bcmath-debuginfoUpgrade php-recode-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-gd-debuginfoUpgrade php-bcmathUpgrade php-snmpUpgrade php-debugsourceUpgrade libzipUpgrade php-xmlUpgrade php-pecl-apcu-debuginfoUpgrade php-enchantUpgrade php-soap-debuginfoUpgrade php-ldap-debuginfoUpgrade php-xmlrpcUpgrade php-embeddedUpgrade php-gdUpgrade php-pecl-rrdUpgrade php-pecl-xdebugUpgrade php-opcache | Mar 12, 2024 | Jul 10, 2019 |
| Suse | — | Upgrade libonig4Upgrade oniguruma-devel | Aug 9, 2024 | Jul 10, 2019 |
| Ubuntu | — | Upgrade php5-xmlrpcUpgrade php5-xmlrpc (Ubuntu Pro)Upgrade php5-fpm (Ubuntu Pro)Upgrade php5-cgi (Ubuntu Pro)Upgrade libapache2-mod-php5Upgrade php5-cgiUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-cli (Ubuntu Pro)Upgrade php5-cliUpgrade php5-fpm | Aug 8, 2019 | Jul 10, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub