A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-opcacheUpgrade php-ldapUpgrade php-enchantUpgrade php-gdUpgrade php-pecl-rrdUpgrade libzip-develUpgrade php-pgsqlUpgrade php-dbgUpgrade php-embeddedUpgrade phpUpgrade php-pecl-apcu-develUpgrade php-odbcUpgrade php-intlUpgrade php-soapUpgrade php-dbaUpgrade apcu-panelUpgrade oniguruma-develUpgrade libzip-toolsUpgrade php-processUpgrade onigurumaUpgrade php-recodeUpgrade php-pearUpgrade php-mysqlndUpgrade php-commonUpgrade php-develUpgrade php-pecl-zipUpgrade php-bcmathUpgrade php-xmlrpcUpgrade libzipUpgrade php-snmpUpgrade php-cliUpgrade php-xmlUpgrade php-gmpUpgrade php-pecl-xdebugUpgrade php-fpmUpgrade php-mbstringUpgrade php-pdoUpgrade php-jsonUpgrade php-pecl-apcu | May 4, 2022 | Jul 10, 2019 |
| Alpine Linux | — | Upgrade php7 | Nov 27, 2019 | Jul 10, 2019 |
| Amazon Linux Ami 2 | — | Upgrade oniguruma-debuginfoUpgrade oniguruma-develUpgrade oniguruma | Apr 27, 2020 | Jul 10, 2019 |
| Amazon_linux | — | Upgrade php71Upgrade php73Upgrade oniguruma | Sep 19, 2019 | Jul 10, 2019 |
| Centos_linux | — | Upgrade php-odbc-debuginfoUpgrade libzipUpgrade libzip-debugsourceUpgrade php-pgsql-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-enchant-debuginfoUpgrade libzip-toolsUpgrade php-dbgUpgrade php-mbstring-debuginfoUpgrade php-gd-debuginfoUpgrade php-pgsqlUpgrade php-pecl-xdebug-debuginfoUpgrade php-dbaUpgrade php-pecl-xdebug-debugsourceUpgrade apcu-panelUpgrade php-odbcUpgrade php-ldapUpgrade php-dba-debuginfoUpgrade phpUpgrade php-cli-debuginfoUpgrade php-fpm-debuginfoUpgrade php-commonUpgrade php-gmp-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-apcuUpgrade php-intlUpgrade php-pecl-apcu-develUpgrade php-soap-debuginfoUpgrade libzip-debuginfoUpgrade php-bcmathUpgrade php-pecl-zip-debuginfoUpgrade php-process-debuginfoUpgrade php-json-debuginfoUpgrade php-soapUpgrade php-bcmath-debuginfoUpgrade php-common-debuginfoUpgrade php-xml-debuginfoUpgrade php-snmp-debuginfoUpgrade php-xmlrpcUpgrade libzip-develUpgrade php-enchantUpgrade php-mysqlndUpgrade php-pecl-zipUpgrade php-snmpUpgrade php-pecl-rrd-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-jsonUpgrade php-opcache-debuginfoUpgrade php-gdUpgrade php-xmlUpgrade php-processUpgrade php-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-recodeUpgrade php-mbstringUpgrade php-pecl-apcu-debuginfoUpgrade php-pdoUpgrade php-intl-debuginfoUpgrade php-gmpUpgrade libzip-tools-debuginfoUpgrade php-pecl-xdebugUpgrade php-pecl-rrdUpgrade php-fpmUpgrade php-embeddedUpgrade php-dbg-debuginfoUpgrade php-embedded-debuginfoUpgrade php-cliUpgrade php-pecl-zip-debugsourceUpgrade php-opcacheUpgrade php-develUpgrade php-debuginfoUpgrade php-recode-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pear | Sep 9, 2020 | Jul 10, 2019 |
| Debian | — | Upgrade libonig | Jul 22, 2019 | Jul 10, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade oniguruma | Sep 8, 2019 | Sep 7, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/oniguruma. | Nov 8, 2019 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade php-mysqlUpgrade php-pdoUpgrade php-processUpgrade php-ldapUpgrade php-soapUpgrade php-gdUpgrade php-pgsqlUpgrade php-odbcUpgrade php-cliUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-commonUpgrade php-xmlUpgrade php | Nov 3, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-processUpgrade php-recodeUpgrade php-pdoUpgrade php-soapUpgrade php-gdUpgrade php-xmlrpcUpgrade php-ldapUpgrade phpUpgrade php-commonUpgrade php-pgsqlUpgrade php-mysqlUpgrade php-odbcUpgrade php-cliUpgrade php-xml | Sep 28, 2020 | Jul 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Sep 30, 2019 | Jul 10, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.3-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/php-71 to version 7.1.32-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/php-73 to version 7.3.9-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Jul 10, 2019 |
| Oracle_linux | — | Upgrade php-cliUpgrade php-ldapUpgrade php-gmpUpgrade php-jsonUpgrade php-recodeUpgrade php-pdoUpgrade php-pecl-xdebugUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-dbgUpgrade php-develUpgrade php-pecl-apcuUpgrade php-bcmathUpgrade AAVMFUpgrade onigurumaUpgrade php-pecl-apcu-develUpgrade php-odbcUpgrade php-embeddedUpgrade php-pearUpgrade php-pecl-zipUpgrade php-enchantUpgrade php-commonUpgrade php-fpmUpgrade libzipUpgrade php-mysqlndUpgrade php-dbaUpgrade php-opcacheUpgrade php-gdUpgrade php-snmpUpgrade apcu-panelUpgrade php-mbstringUpgrade php-pecl-rrdUpgrade php-intlUpgrade oniguruma-develUpgrade php-pgsqlUpgrade php-processUpgrade phpUpgrade libzip-develUpgrade OVMFUpgrade libzip-toolsUpgrade php-soap | Sep 10, 2020 | Jun 27, 2019 |
| Php | — | Upgrade to PHP version 7.2.23Upgrade to PHP version 7.3.9Upgrade to PHP version 7.1.32 | Sep 15, 2022 | Jul 10, 2019 |
| Redhat_linux | — | Upgrade libzipUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-enchantUpgrade php-process-debuginfoUpgrade oniguruma-develUpgrade php-opcacheUpgrade php-soap-debuginfoUpgrade php-cliUpgrade php-ldap-debuginfoUpgrade php-embeddedUpgrade libzip-develUpgrade php-dbgUpgrade php-pecl-apcu-debugsourceUpgrade php-bcmath-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-gmp-debuginfoUpgrade php-debuginfoUpgrade php-recodeUpgrade php-recode-debuginfoUpgrade php-snmp-debuginfoUpgrade onigurumaUpgrade php-common-debuginfoUpgrade php-xmlUpgrade oniguruma-debugsourceUpgrade php-fpm-debuginfoUpgrade php-gd-debuginfoUpgrade php-intlUpgrade phpUpgrade libzip-toolsUpgrade php-snmpUpgrade apcu-panelUpgrade php-pgsql-debuginfoUpgrade php-ldapUpgrade php-debugsourceUpgrade php-mysqlndUpgrade php-embedded-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pdoUpgrade php-mbstring-debuginfoUpgrade php-fpmUpgrade php-pecl-apcu-develNo solution existsUpgrade php-pecl-apcuUpgrade php-enchant-debuginfoUpgrade php-json-debuginfoUpgrade php-jsonUpgrade php-dbg-debuginfoUpgrade php-xml-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-xmlrpcUpgrade php-develUpgrade libzip-tools-debuginfoUpgrade php-mbstringUpgrade php-opcache-debuginfoUpgrade php-gdUpgrade php-soapUpgrade libzip-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-odbc-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade libzip-debugsourceUpgrade php-bcmathUpgrade php-processUpgrade php-pdo-debuginfoUpgrade php-dba-debuginfoUpgrade php-intl-debuginfoUpgrade php-pgsqlUpgrade php-cli-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-gmpUpgrade php-pecl-zipUpgrade php-dbaUpgrade php-odbcUpgrade php-pecl-xdebugUpgrade php-commonUpgrade php-pearUpgrade php-pecl-rrd-debuginfoUpgrade oniguruma-debuginfoUpgrade php-pecl-rrd | Sep 9, 2020 | Jul 10, 2019 |
| Rocky_linux | — | Upgrade php-pecl-apcu-debugsourceUpgrade php-gmpUpgrade php-intl-debuginfoUpgrade php-pdoUpgrade php-mbstringUpgrade php-odbcUpgrade php-mbstring-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-dbgUpgrade php-fpm-debuginfoUpgrade php-dba-debuginfoUpgrade libzip-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-pgsqlUpgrade php-pecl-xdebug-debuginfoUpgrade php-jsonUpgrade php-enchant-debuginfoUpgrade php-odbc-debuginfoUpgrade libzip-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-cli-debuginfoUpgrade php-develUpgrade php-dbaUpgrade php-pecl-apcu-develUpgrade php-opcache-debuginfoUpgrade php-commonUpgrade php-soapUpgrade php-common-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-zip-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-json-debuginfoUpgrade php-xml-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-fpmUpgrade php-pecl-xdebug-debugsourceUpgrade php-pdo-debuginfoUpgrade php-process-debuginfoUpgrade php-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-bcmathUpgrade php-opcacheUpgrade libzip-develUpgrade php-gdUpgrade php-pecl-rrdUpgrade php-xmlrpcUpgrade php-pecl-xdebugUpgrade php-embeddedUpgrade php-snmpUpgrade php-soap-debuginfoUpgrade php-processUpgrade php-snmp-debuginfoUpgrade php-recodeUpgrade php-ldapUpgrade php-gmp-debuginfoUpgrade php-dbg-debuginfoUpgrade php-enchantUpgrade php-pgsql-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-zipUpgrade php-intlUpgrade libzip-toolsUpgrade phpUpgrade php-debugsourceUpgrade php-cliUpgrade php-recode-debuginfoUpgrade php-xmlUpgrade libzipUpgrade php-pecl-apcu-debuginfoUpgrade php-mysqlndUpgrade php-embedded-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-gd-debuginfo | Mar 12, 2024 | Jul 10, 2019 |
| Suse | — | Upgrade libonig4Upgrade oniguruma-devel | Aug 9, 2024 | Jul 10, 2019 |
| Ubuntu | — | Upgrade php5-xmlrpc (Ubuntu Pro)Upgrade libapache2-mod-php5Upgrade php5-fpm (Ubuntu Pro)Upgrade php5-cgi (Ubuntu Pro)Upgrade php5-xmlrpcUpgrade php5-cli (Ubuntu Pro)Upgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-cliUpgrade php5-cgiUpgrade php5-fpm | Aug 8, 2019 | Jul 10, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub