A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-mysqlndUpgrade php-pecl-zipUpgrade php-pecl-xdebugUpgrade php-bcmathUpgrade php-mbstringUpgrade php-commonUpgrade php-pdoUpgrade onigurumaUpgrade php-pecl-apcuUpgrade php-fpmUpgrade libzipUpgrade php-pearUpgrade php-gmpUpgrade php-xmlUpgrade php-snmpUpgrade php-xmlrpcUpgrade php-cliUpgrade php-develUpgrade php-jsonUpgrade php-recodeUpgrade php-ldapUpgrade php-enchantUpgrade phpUpgrade php-pecl-apcu-develUpgrade php-dbgUpgrade php-soapUpgrade php-pgsqlUpgrade libzip-toolsUpgrade php-processUpgrade php-intlUpgrade php-embeddedUpgrade libzip-develUpgrade php-pecl-rrdUpgrade php-odbcUpgrade php-gdUpgrade php-opcacheUpgrade php-dbaUpgrade apcu-panelUpgrade oniguruma-devel | May 4, 2022 | Jul 10, 2019 |
| Alpine Linux | — | Upgrade php7 | Nov 27, 2019 | Jul 10, 2019 |
| Amazon Linux Ami 2 | — | Upgrade oniguruma-debuginfoUpgrade oniguruma-develUpgrade oniguruma | Apr 27, 2020 | Jul 10, 2019 |
| Amazon_linux | — | Upgrade onigurumaUpgrade php71Upgrade php73 | Sep 19, 2019 | Jul 10, 2019 |
| Centos_linux | — | Upgrade php-odbc-debuginfoUpgrade libzip-toolsUpgrade libzipUpgrade php-pecl-xdebug-debugsourceUpgrade php-soap-debuginfoUpgrade php-json-debuginfoUpgrade libzip-debugsourceUpgrade php-dbgUpgrade php-intlUpgrade php-fpm-debuginfoUpgrade php-dbaUpgrade php-odbcUpgrade php-pdo-debuginfoUpgrade php-dba-debuginfoUpgrade php-pgsqlUpgrade apcu-panelUpgrade php-pgsql-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-common-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-gmp-debuginfoUpgrade php-soapUpgrade php-bcmathUpgrade phpUpgrade php-pecl-apcu-develUpgrade php-process-debuginfoUpgrade php-commonUpgrade php-pecl-apcuUpgrade php-pecl-apcu-debugsourceUpgrade libzip-debuginfoUpgrade php-cli-debuginfoUpgrade php-xml-debuginfoUpgrade php-enchant-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-gd-debuginfoUpgrade php-ldapUpgrade php-embedded-debuginfoUpgrade php-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-mbstringUpgrade php-enchantUpgrade php-xmlUpgrade php-recode-debuginfoUpgrade php-mysqlndUpgrade php-mysqlnd-debuginfoUpgrade php-develUpgrade php-snmpUpgrade php-pecl-zipUpgrade libzip-develUpgrade php-debuginfoUpgrade php-intl-debuginfoUpgrade php-pecl-rrdUpgrade php-cliUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-xdebugUpgrade libzip-tools-debuginfoUpgrade php-fpmUpgrade php-embeddedUpgrade php-dbg-debuginfoUpgrade php-snmp-debuginfoUpgrade php-opcacheUpgrade php-pecl-rrd-debugsourceUpgrade php-gmpUpgrade php-xmlrpcUpgrade php-xmlrpc-debuginfoUpgrade php-jsonUpgrade php-pearUpgrade php-pecl-apcu-debuginfoUpgrade php-ldap-debuginfoUpgrade php-gdUpgrade php-pdoUpgrade php-opcache-debuginfoUpgrade php-processUpgrade php-recode | Sep 9, 2020 | Jul 10, 2019 |
| Debian | — | Upgrade libonig | Jul 22, 2019 | Jul 10, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade oniguruma | Sep 8, 2019 | Sep 7, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/oniguruma. | Nov 8, 2019 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-gdUpgrade php-odbcUpgrade php-pgsqlUpgrade php-soapUpgrade php-processUpgrade php-ldapUpgrade php-pdoUpgrade php-mysqlUpgrade php-commonUpgrade php-xmlUpgrade php-cliUpgrade phpUpgrade php-xmlrpcUpgrade php-recode | Nov 3, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-gdUpgrade php-processUpgrade php-recodeUpgrade php-pdoUpgrade php-soapUpgrade phpUpgrade php-ldapUpgrade php-xmlrpcUpgrade php-odbcUpgrade php-xmlUpgrade php-cliUpgrade php-mysqlUpgrade php-commonUpgrade php-pgsql | Sep 28, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Sep 30, 2019 | Jul 10, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.3-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Jul 10, 2019 |
| Oracle_linux | — | Upgrade php-commonUpgrade php-bcmathUpgrade AAVMFUpgrade php-recodeUpgrade php-jsonUpgrade php-enchantUpgrade php-gmpUpgrade php-pecl-xdebugUpgrade php-cliUpgrade php-xmlUpgrade php-embeddedUpgrade php-xmlrpcUpgrade php-develUpgrade php-pecl-zipUpgrade libzipUpgrade onigurumaUpgrade php-dbgUpgrade php-pearUpgrade php-pecl-apcuUpgrade php-pdoUpgrade php-fpmUpgrade php-ldapUpgrade php-pecl-apcu-develUpgrade php-odbcUpgrade php-pgsqlUpgrade php-intlUpgrade php-gdUpgrade php-opcacheUpgrade php-pecl-rrdUpgrade OVMFUpgrade php-mysqlndUpgrade php-mbstringUpgrade php-processUpgrade phpUpgrade libzip-develUpgrade apcu-panelUpgrade php-snmpUpgrade php-soapUpgrade oniguruma-develUpgrade php-dbaUpgrade libzip-tools | Sep 10, 2020 | Jun 27, 2019 |
| Php | — | Upgrade to PHP version 7.1.32Upgrade to PHP version 7.3.9Upgrade to PHP version 7.2.23 | Sep 15, 2022 | Jul 10, 2019 |
| Redhat_linux | — | No solution existsUpgrade php-pecl-zipUpgrade php-pecl-rrdUpgrade libzip-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-processUpgrade php-commonUpgrade php-pearUpgrade php-pecl-rrd-debuginfoUpgrade php-bcmathUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-develUpgrade oniguruma-debuginfoUpgrade php-pdo-debuginfoUpgrade php-mbstringUpgrade php-mbstring-debuginfoUpgrade php-enchant-debuginfoUpgrade php-cli-debuginfoUpgrade php-opcache-debuginfoUpgrade php-dbaUpgrade php-jsonUpgrade php-pecl-xdebugUpgrade php-gmpUpgrade php-odbcUpgrade php-dba-debuginfoUpgrade php-soapUpgrade php-pdoUpgrade php-odbc-debuginfoUpgrade php-intl-debuginfoUpgrade php-xml-debuginfoUpgrade php-xmlrpcUpgrade php-xmlrpc-debuginfoUpgrade libzip-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-json-debuginfoUpgrade php-fpmUpgrade php-pgsqlUpgrade php-pecl-apcuUpgrade php-gdUpgrade php-dbg-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-develUpgrade php-intlUpgrade libzipUpgrade php-ldapUpgrade php-pecl-apcu-debuginfoUpgrade php-ldap-debuginfoUpgrade php-dbgUpgrade php-embeddedUpgrade libzip-develUpgrade oniguruma-develUpgrade php-gd-debuginfoUpgrade php-xmlUpgrade php-process-debuginfoUpgrade php-recode-debuginfoUpgrade libzip-toolsUpgrade php-debugsourceUpgrade php-common-debuginfoUpgrade phpUpgrade php-recodeUpgrade php-enchantUpgrade php-debuginfoUpgrade php-gmp-debuginfoUpgrade php-embedded-debuginfoUpgrade php-mysqlndUpgrade php-pgsql-debuginfoUpgrade php-snmp-debuginfoUpgrade onigurumaUpgrade apcu-panelUpgrade php-opcacheUpgrade php-pecl-rrd-debugsourceUpgrade oniguruma-debugsourceUpgrade php-snmpUpgrade php-soap-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-cliUpgrade php-bcmath-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-fpm-debuginfo | Sep 9, 2020 | Jul 10, 2019 |
| Rocky_linux | — | Upgrade php-bcmath-debuginfoUpgrade php-cliUpgrade php-recode-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-zipUpgrade libzip-toolsUpgrade php-embedded-debuginfoUpgrade php-intlUpgrade php-mysqlndUpgrade phpUpgrade php-dbg-debuginfoUpgrade php-snmp-debuginfoUpgrade php-gmp-debuginfoUpgrade php-embeddedUpgrade php-processUpgrade php-recodeUpgrade php-ldapUpgrade php-gdUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-rrdUpgrade php-ldap-debuginfoUpgrade php-xmlUpgrade php-opcacheUpgrade libzipUpgrade php-snmpUpgrade php-debugsourceUpgrade libzip-develUpgrade php-pecl-xdebugUpgrade php-bcmathUpgrade php-soap-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-gd-debuginfoUpgrade php-enchantUpgrade php-xmlrpcUpgrade php-cli-debuginfoUpgrade php-develUpgrade php-pdo-debuginfoUpgrade php-gmpUpgrade php-json-debuginfoUpgrade php-enchant-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-fpmUpgrade php-xmlrpc-debuginfoUpgrade php-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-jsonUpgrade php-pecl-xdebug-debuginfoUpgrade php-dbaUpgrade php-pecl-zip-debuginfoUpgrade php-odbcUpgrade php-mbstring-debuginfoUpgrade php-mbstringUpgrade libzip-debuginfoUpgrade php-odbc-debuginfoUpgrade php-dbgUpgrade php-fpm-debuginfoUpgrade php-dba-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-apcu-develUpgrade php-opcache-debuginfoUpgrade php-pdoUpgrade php-intl-debuginfoUpgrade libzip-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-pgsqlUpgrade php-pecl-zip-debugsourceUpgrade php-soapUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-apcu-debugsourceUpgrade php-commonUpgrade php-common-debuginfo | Mar 12, 2024 | Jul 10, 2019 |
| Suse | — | Upgrade libonig4Upgrade oniguruma-devel | Aug 9, 2024 | Jul 10, 2019 |
| Ubuntu | — | Upgrade php5-cgi (Ubuntu Pro)Upgrade php5-fpm (Ubuntu Pro)Upgrade php5-xmlrpcUpgrade php5-xmlrpc (Ubuntu Pro)Upgrade libapache2-mod-php5Upgrade php5-fpmUpgrade php5-cliUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-cgiUpgrade php5-cli (Ubuntu Pro) | Aug 8, 2019 | Jul 10, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub