A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-mbstringUpgrade php-fpmUpgrade php-pecl-xdebugUpgrade php-pecl-zipUpgrade onigurumaUpgrade php-recodeUpgrade php-cliUpgrade php-gmpUpgrade php-pecl-apcuUpgrade libzipUpgrade php-develUpgrade php-bcmathUpgrade php-snmpUpgrade php-pdoUpgrade php-mysqlndUpgrade php-pearUpgrade php-jsonUpgrade php-commonUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-soapUpgrade php-pecl-rrdUpgrade php-pgsqlUpgrade libzip-toolsUpgrade php-ldapUpgrade php-processUpgrade php-opcacheUpgrade php-pecl-apcu-develUpgrade phpUpgrade php-dbgUpgrade php-gdUpgrade apcu-panelUpgrade php-embeddedUpgrade libzip-develUpgrade oniguruma-develUpgrade php-dbaUpgrade php-enchantUpgrade php-odbcUpgrade php-intl | May 4, 2022 | Jul 10, 2019 |
| Alpine Linux | — | Upgrade php7 | Nov 27, 2019 | Jul 10, 2019 |
| Amazon Linux Ami 2 | — | Upgrade oniguruma-develUpgrade oniguruma-debuginfoUpgrade oniguruma | Apr 27, 2020 | Jul 10, 2019 |
| Amazon_linux | — | Upgrade onigurumaUpgrade php71Upgrade php73 | Sep 19, 2019 | Jul 10, 2019 |
| Centos_linux | — | Upgrade php-odbcUpgrade php-dba-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pdo-debuginfoUpgrade php-dbaUpgrade php-process-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-fpm-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pecl-apcu-develUpgrade phpUpgrade php-bcmathUpgrade php-pecl-apcuUpgrade php-common-debuginfoUpgrade php-pgsqlUpgrade php-soapUpgrade libzip-debuginfoUpgrade php-xml-debuginfoUpgrade php-gmp-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-ldapUpgrade php-gd-debuginfoUpgrade php-intlUpgrade php-pecl-apcu-debugsourceUpgrade php-soap-debuginfoUpgrade php-json-debuginfoUpgrade php-enchant-debuginfoUpgrade libzip-toolsUpgrade apcu-panelUpgrade php-commonUpgrade php-cli-debuginfoUpgrade php-dbgUpgrade php-odbc-debuginfoUpgrade libzipUpgrade libzip-debugsourceUpgrade php-opcache-debuginfoUpgrade php-develUpgrade php-snmp-debuginfoUpgrade php-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-xmlrpcUpgrade php-pearUpgrade php-pecl-rrdUpgrade php-debuginfoUpgrade php-intl-debuginfoUpgrade php-jsonUpgrade php-snmpUpgrade php-gdUpgrade libzip-develUpgrade php-pecl-zipUpgrade php-pecl-apcu-debuginfoUpgrade php-pdoUpgrade php-mbstringUpgrade php-recode-debuginfoUpgrade php-mysqlndUpgrade php-processUpgrade php-gmpUpgrade php-opcacheUpgrade php-pecl-rrd-debugsourceUpgrade php-cliUpgrade php-mysqlnd-debuginfoUpgrade php-enchantUpgrade php-xmlUpgrade php-recodeUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-fpmUpgrade php-ldap-debuginfoUpgrade php-pecl-xdebugUpgrade php-dbg-debuginfoUpgrade php-embedded-debuginfoUpgrade php-embeddedUpgrade php-pecl-zip-debugsource | Sep 9, 2020 | Jul 10, 2019 |
| Debian | — | Upgrade libonig | Jul 22, 2019 | Jul 10, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade oniguruma | Sep 8, 2019 | Sep 7, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/oniguruma. | Nov 8, 2019 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-cliUpgrade php-xmlUpgrade phpUpgrade php-recodeUpgrade php-commonUpgrade php-xmlrpcUpgrade php-ldapUpgrade php-mysqlUpgrade php-odbcUpgrade php-gdUpgrade php-soapUpgrade php-pgsqlUpgrade php-pdoUpgrade php-process | Nov 3, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-commonUpgrade php-pgsqlUpgrade php-mysqlUpgrade php-cliUpgrade php-xmlUpgrade php-odbcUpgrade php-recodeUpgrade php-gdUpgrade php-xmlrpcUpgrade php-pdoUpgrade php-soapUpgrade php-ldapUpgrade phpUpgrade php-process | Sep 28, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Sep 30, 2019 | Jul 10, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.3-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Jul 10, 2019 |
| Oracle_linux | — | Upgrade php-soapUpgrade libzip-toolsUpgrade php-dbaUpgrade php-intlUpgrade phpUpgrade php-pecl-rrdUpgrade oniguruma-develUpgrade libzip-develUpgrade php-gdUpgrade php-snmpUpgrade apcu-panelUpgrade php-processUpgrade php-opcacheUpgrade php-pgsqlUpgrade php-mbstringUpgrade OVMFUpgrade php-mysqlndUpgrade php-dbgUpgrade php-enchantUpgrade php-jsonUpgrade php-pecl-apcu-develUpgrade php-develUpgrade php-odbcUpgrade php-pdoUpgrade php-fpmUpgrade php-pecl-zipUpgrade libzipUpgrade onigurumaUpgrade php-embeddedUpgrade AAVMFUpgrade php-bcmathUpgrade php-cliUpgrade php-xmlrpcUpgrade php-ldapUpgrade php-recodeUpgrade php-gmpUpgrade php-commonUpgrade php-pecl-xdebugUpgrade php-pecl-apcuUpgrade php-xmlUpgrade php-pear | Sep 10, 2020 | Jun 27, 2019 |
| Php | — | Upgrade to PHP version 7.1.32Upgrade to PHP version 7.3.9Upgrade to PHP version 7.2.23 | Sep 15, 2022 | Jul 10, 2019 |
| Redhat_linux | — | Upgrade php-mbstring-debuginfoUpgrade php-gdUpgrade php-jsonUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-xdebugUpgrade php-pearUpgrade php-processUpgrade php-pecl-zipUpgrade php-xmlrpcUpgrade php-intl-debuginfoUpgrade php-gmpUpgrade php-cli-debuginfoUpgrade php-json-debuginfoUpgrade php-pdoUpgrade php-soapUpgrade php-fpmUpgrade php-pecl-xdebug-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pgsqlUpgrade libzip-tools-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-apcuUpgrade php-develUpgrade libzip-debugsourceUpgrade php-pecl-rrdUpgrade php-dba-debuginfoNo solution existsUpgrade php-pecl-xdebug-debugsourceUpgrade php-mbstringUpgrade php-bcmathUpgrade php-odbcUpgrade php-opcache-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-odbc-debuginfoUpgrade php-dbaUpgrade php-pecl-rrd-debuginfoUpgrade php-commonUpgrade oniguruma-debuginfoUpgrade php-enchant-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade libzip-debuginfoUpgrade php-dbg-debuginfoUpgrade php-pecl-apcu-develUpgrade oniguruma-develUpgrade php-debugsourceUpgrade phpUpgrade php-process-debuginfoUpgrade onigurumaUpgrade php-bcmath-debuginfoUpgrade libzip-toolsUpgrade php-cliUpgrade php-gmp-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-intlUpgrade php-recodeUpgrade php-recode-debuginfoUpgrade libzip-develUpgrade php-ldap-debuginfoUpgrade php-dbgUpgrade php-embeddedUpgrade php-opcacheUpgrade php-fpm-debuginfoUpgrade php-mysqlndUpgrade php-pecl-apcu-debuginfoUpgrade php-embedded-debuginfoUpgrade php-xmlUpgrade php-pgsql-debuginfoUpgrade php-enchantUpgrade php-snmpUpgrade apcu-panelUpgrade php-common-debuginfoUpgrade php-debuginfoUpgrade libzipUpgrade php-soap-debuginfoUpgrade php-snmp-debuginfoUpgrade oniguruma-debugsourceUpgrade php-gd-debuginfoUpgrade php-ldap | Sep 9, 2020 | Jul 10, 2019 |
| Rocky_linux | — | Upgrade php-intlUpgrade libzip-toolsUpgrade libzip-develUpgrade php-pecl-xdebugUpgrade php-gdUpgrade php-embeddedUpgrade php-pecl-rrd-debugsourceUpgrade php-ldap-debuginfoUpgrade php-xmlrpcUpgrade php-processUpgrade php-gmp-debuginfoUpgrade php-snmp-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-cliUpgrade php-bcmath-debuginfoUpgrade php-ldapUpgrade php-enchantUpgrade php-mysqlndUpgrade php-embedded-debuginfoUpgrade php-recodeUpgrade php-recode-debuginfoUpgrade php-xmlUpgrade php-dbg-debuginfoUpgrade phpUpgrade php-pecl-zipUpgrade php-pecl-rrdUpgrade libzipUpgrade php-soap-debuginfoUpgrade php-debugsourceUpgrade php-bcmathUpgrade php-gd-debuginfoUpgrade php-snmpUpgrade php-opcacheUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcuUpgrade php-pecl-xdebug-debuginfoUpgrade php-odbc-debuginfoUpgrade libzip-debuginfoUpgrade php-fpm-debuginfoUpgrade php-dba-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-pdo-debuginfoUpgrade php-xml-debuginfoUpgrade php-odbcUpgrade php-jsonUpgrade libzip-tools-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-gmpUpgrade php-mbstring-debuginfoUpgrade php-pgsqlUpgrade php-develUpgrade php-cli-debuginfoUpgrade php-common-debuginfoUpgrade libzip-debugsourceUpgrade php-commonUpgrade php-pecl-rrd-debuginfoUpgrade php-enchant-debuginfoUpgrade php-dbgUpgrade php-dbaUpgrade php-pecl-apcu-debugsourceUpgrade php-mbstringUpgrade php-process-debuginfoUpgrade php-fpmUpgrade php-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-opcache-debuginfoUpgrade php-intl-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-soap | Mar 12, 2024 | Jul 10, 2019 |
| Suse | — | Upgrade libonig4Upgrade oniguruma-devel | Aug 9, 2024 | Jul 10, 2019 |
| Ubuntu | — | Upgrade php5-xmlrpc (Ubuntu Pro)Upgrade php5-xmlrpcUpgrade php5-cgi (Ubuntu Pro)Upgrade php5-fpm (Ubuntu Pro)Upgrade libapache2-mod-php5Upgrade php5-cliUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-cli (Ubuntu Pro)Upgrade php5-cgiUpgrade php5-fpm | Aug 8, 2019 | Jul 10, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub