A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pgsqlUpgrade libzip-toolsUpgrade php-odbcUpgrade libzip-develUpgrade php-intlUpgrade php-pecl-rrdUpgrade php-enchantUpgrade php-gdUpgrade php-dbgUpgrade php-soapUpgrade php-embeddedUpgrade php-dbaUpgrade php-opcacheUpgrade phpUpgrade php-ldapUpgrade oniguruma-develUpgrade php-pecl-apcu-develUpgrade php-processUpgrade apcu-panelUpgrade php-jsonUpgrade php-mysqlndUpgrade php-recodeUpgrade php-pecl-apcuUpgrade php-fpmUpgrade php-xmlrpcUpgrade php-pearUpgrade php-snmpUpgrade php-pecl-zipUpgrade libzipUpgrade php-bcmathUpgrade onigurumaUpgrade php-xmlUpgrade php-commonUpgrade php-pdoUpgrade php-develUpgrade php-cliUpgrade php-pecl-xdebugUpgrade php-gmpUpgrade php-mbstring | May 4, 2022 | Jul 10, 2019 |
| Alpine Linux | — | Upgrade php7 | Nov 27, 2019 | Jul 10, 2019 |
| Amazon Linux Ami 2 | — | Upgrade oniguruma-debuginfoUpgrade oniguruma-develUpgrade oniguruma | Apr 27, 2020 | Jul 10, 2019 |
| Amazon_linux | — | Upgrade onigurumaUpgrade php73Upgrade php71 | Sep 19, 2019 | Jul 10, 2019 |
| Centos_linux | — | Upgrade php-cli-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-dbgUpgrade php-odbc-debuginfoUpgrade php-fpm-debuginfoUpgrade libzip-toolsUpgrade libzipUpgrade libzip-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pgsqlUpgrade php-odbcUpgrade php-dba-debuginfoUpgrade apcu-panelUpgrade php-bcmathUpgrade libzip-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pecl-apcu-develUpgrade php-ldapUpgrade php-intlUpgrade php-pecl-apcu-debugsourceUpgrade php-process-debuginfoUpgrade php-gmp-debuginfoUpgrade php-xml-debuginfoUpgrade php-soapUpgrade php-gd-debuginfoUpgrade php-pecl-apcuUpgrade phpUpgrade php-commonUpgrade php-mbstring-debuginfoUpgrade php-soap-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-common-debuginfoUpgrade php-pdo-debuginfoUpgrade php-dbaUpgrade php-embedded-debuginfoUpgrade php-processUpgrade php-embeddedUpgrade php-opcache-debuginfoUpgrade php-recodeUpgrade php-ldap-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-gdUpgrade php-pearUpgrade php-pecl-xdebugUpgrade libzip-develUpgrade php-snmpUpgrade php-pecl-zipUpgrade php-xmlrpcUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-opcacheUpgrade libzip-tools-debuginfoUpgrade php-debuginfoUpgrade php-cliUpgrade php-intl-debuginfoUpgrade php-fpmUpgrade php-dbg-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pdoUpgrade php-jsonUpgrade php-mbstringUpgrade php-pecl-rrd-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-rrdUpgrade php-snmp-debuginfoUpgrade php-debugsourceUpgrade php-recode-debuginfoUpgrade php-xmlUpgrade php-develUpgrade php-mysqlndUpgrade php-gmpUpgrade php-enchant | Sep 9, 2020 | Jul 10, 2019 |
| Debian | — | Upgrade libonig | Jul 22, 2019 | Jul 10, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade oniguruma | Sep 8, 2019 | Sep 7, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/oniguruma. | Nov 8, 2019 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-ldapUpgrade php-gdUpgrade php-odbcUpgrade php-mysqlUpgrade php-pdoUpgrade php-processUpgrade php-soapUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-commonUpgrade phpUpgrade php-cliUpgrade php-recodeUpgrade php-xml | Nov 3, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-ldapUpgrade phpUpgrade php-recodeUpgrade php-processUpgrade php-xmlrpcUpgrade php-gdUpgrade php-pdoUpgrade php-soapUpgrade php-xmlUpgrade php-commonUpgrade php-pgsqlUpgrade php-odbcUpgrade php-mysqlUpgrade php-cli | Sep 28, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Sep 30, 2019 | Jul 10, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.3-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Jul 10, 2019 |
| Oracle_linux | — | Upgrade php-snmpUpgrade php-mbstringUpgrade php-pecl-rrdUpgrade php-pgsqlUpgrade php-gdUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-processUpgrade phpUpgrade php-intlUpgrade php-dbaUpgrade libzip-develUpgrade php-soapUpgrade OVMFUpgrade apcu-panelUpgrade libzip-toolsUpgrade oniguruma-develUpgrade php-ldapUpgrade php-cliUpgrade php-embeddedUpgrade php-pdoUpgrade php-pecl-xdebugUpgrade php-jsonUpgrade php-commonUpgrade php-pecl-zipUpgrade php-fpmUpgrade php-pearUpgrade php-odbcUpgrade php-pecl-apcu-develUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-gmpUpgrade php-develUpgrade php-enchantUpgrade php-pecl-apcuUpgrade php-xmlUpgrade php-dbgUpgrade php-bcmathUpgrade libzipUpgrade onigurumaUpgrade AAVMF | Sep 10, 2020 | Jun 27, 2019 |
| Php | — | Upgrade to PHP version 7.1.32Upgrade to PHP version 7.3.9Upgrade to PHP version 7.2.23 | Sep 15, 2022 | Jul 10, 2019 |
| Redhat_linux | — | Upgrade php-cli-debuginfoUpgrade php-enchant-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-develUpgrade php-pecl-zip-debugsourceUpgrade php-gdUpgrade php-gmpUpgrade php-pecl-xdebug-debugsourceUpgrade php-pdoUpgrade php-dba-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-intl-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-commonUpgrade php-opcache-debuginfoUpgrade php-jsonUpgrade php-odbcUpgrade php-mbstringUpgrade php-pecl-xdebugUpgrade php-processUpgrade libzip-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pearUpgrade oniguruma-debuginfoUpgrade php-pecl-apcuUpgrade php-fpmUpgrade php-odbc-debuginfoUpgrade php-json-debuginfoUpgrade php-pdo-debuginfoUpgrade php-dbaUpgrade php-soapUpgrade php-mbstring-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-rrdUpgrade libzip-debugsourceUpgrade php-pecl-zipUpgrade php-bcmathUpgrade php-xml-debuginfoUpgrade php-xmlrpcUpgrade php-pgsqlUpgrade php-dbg-debuginfoNo solution existsUpgrade apcu-panelUpgrade php-pecl-apcu-debuginfoUpgrade php-mysqlndUpgrade php-xmlUpgrade php-embedded-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-recode-debuginfoUpgrade php-soap-debuginfoUpgrade phpUpgrade php-process-debuginfoUpgrade oniguruma-develUpgrade php-bcmath-debuginfoUpgrade php-common-debuginfoUpgrade libzip-toolsUpgrade php-debugsourceUpgrade php-cliUpgrade php-embeddedUpgrade libzip-develUpgrade php-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-gmp-debuginfoUpgrade libzipUpgrade php-pecl-apcu-debugsourceUpgrade php-recodeUpgrade php-fpm-debuginfoUpgrade php-ldap-debuginfoUpgrade php-dbgUpgrade php-opcacheUpgrade oniguruma-debugsourceUpgrade php-snmpUpgrade php-pecl-zip-debuginfoUpgrade onigurumaUpgrade php-gd-debuginfoUpgrade php-snmp-debuginfoUpgrade php-intlUpgrade php-ldapUpgrade php-enchant | Sep 9, 2020 | Jul 10, 2019 |
| Rocky_linux | — | Upgrade php-pecl-apcu-develUpgrade php-fpm-debuginfoUpgrade php-pdoUpgrade php-dbaUpgrade php-intl-debuginfoUpgrade php-dbgUpgrade php-mbstringUpgrade php-odbc-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-debuginfoUpgrade php-soapUpgrade php-pdo-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-xdebug-debugsourceUpgrade php-process-debuginfoUpgrade php-dba-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pgsqlUpgrade php-odbcUpgrade php-jsonUpgrade php-enchant-debuginfoUpgrade php-json-debuginfoUpgrade php-gmpUpgrade php-develUpgrade php-cli-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-common-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade libzip-debugsourceUpgrade php-fpmUpgrade php-commonUpgrade php-xmlUpgrade php-soap-debuginfoUpgrade php-xmlrpcUpgrade php-embeddedUpgrade php-gdUpgrade php-ldap-debuginfoUpgrade php-recode-debuginfoUpgrade php-enchantUpgrade php-pecl-rrdUpgrade phpUpgrade php-dbg-debuginfoUpgrade php-ldapUpgrade php-gmp-debuginfoUpgrade php-snmp-debuginfoUpgrade php-recodeUpgrade php-processUpgrade php-opcacheUpgrade php-embedded-debuginfoUpgrade libzip-develUpgrade php-pecl-xdebugUpgrade php-pgsql-debuginfoUpgrade php-intlUpgrade php-pecl-zipUpgrade libzip-toolsUpgrade php-gd-debuginfoUpgrade php-bcmathUpgrade php-snmpUpgrade php-pecl-rrd-debugsourceUpgrade php-cliUpgrade php-mysqlndUpgrade php-bcmath-debuginfoUpgrade libzipUpgrade php-debugsourceUpgrade php-pecl-apcu-debuginfo | Mar 12, 2024 | Jul 10, 2019 |
| Suse | — | Upgrade oniguruma-develUpgrade libonig4 | Aug 9, 2024 | Jul 10, 2019 |
| Ubuntu | — | Upgrade php5-fpm (Ubuntu Pro)Upgrade php5-xmlrpc (Ubuntu Pro)Upgrade php5-cgi (Ubuntu Pro)Upgrade php5-xmlrpcUpgrade libapache2-mod-php5Upgrade php5-cliUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-fpmUpgrade php5-cli (Ubuntu Pro)Upgrade php5-cgi | Aug 8, 2019 | Jul 10, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub