An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubyUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubygem-bsonUpgrade ruby-develUpgrade rubygem-mongo-docUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade rubygem-opensslUpgrade rubygem-bundler-docUpgrade rubygem-power_assertUpgrade rubygem-psychUpgrade rubygem-xmlrpcUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade ruby-libsUpgrade rubygem-net-telnetUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-bson-docUpgrade oniguruma-develUpgrade rubygem-minitestUpgrade rubygem-pgUpgrade onigurumaUpgrade rubygems | Feb 23, 2024 | Nov 17, 2019 |
| Alpine Linux | — | Upgrade oniguruma | Jan 3, 2020 | Nov 17, 2019 |
| Amazon Linux Ami 2 | — | Upgrade oniguruma-develUpgrade onigurumaUpgrade oniguruma-debuginfo | Apr 27, 2020 | Nov 17, 2019 |
| Debian | — | Upgrade libonig | Dec 5, 2019 | Nov 17, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.4-11.4.17.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 17, 2019 |
| Oracle_linux | — | Upgrade rubygem-mongoUpgrade rubygem-test-unitUpgrade rubygem-net-telnetUpgrade rubygem-bsonUpgrade rubygem-minitestUpgrade rubygem-mysql2Upgrade rubygem-rdocUpgrade rubygem-power_assertUpgrade ruby-develUpgrade rubygem-abrt-docUpgrade rubygem-bundlerUpgrade rubygem-xmlrpcUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-bundler-docUpgrade oniguruma-develUpgrade rubygem-abrtUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade onigurumaUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade rubygem-bson-docUpgrade ruby-libsUpgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-did_you_mean | Feb 21, 2024 | Nov 8, 2019 |
| Redhat_linux | — | Upgrade rubygem-bson-debugsourceUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-abrtUpgrade ruby-libs-debuginfoUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-mysql2No solution existsUpgrade rubygem-rdocUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygem-mongoUpgrade onigurumaUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade oniguruma-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-psych-debuginfoUpgrade rubygem-jsonUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-pg-docUpgrade rubygem-bsonUpgrade oniguruma-debugsourceUpgrade rubygem-bundler-docUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade ruby-irbUpgrade rubygem-openssl-debuginfoUpgrade rubygem-xmlrpcUpgrade oniguruma-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygems-develUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-did_you_meanUpgrade rubygem-bson-docUpgrade rubygem-mongo-docUpgrade rubygem-rake | Jan 26, 2024 | Nov 17, 2019 |
| Rocky_linux | — | Upgrade rubygem-pgUpgrade ruby-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bsonUpgrade rubygem-json-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade rubygem-jsonUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubyUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-opensslUpgrade ruby-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2 | Jul 31, 2025 | Jul 29, 2025 |
| Ubuntu | — | Upgrade libonig4 (Ubuntu Pro)Upgrade libonig2 (Ubuntu Pro) | Aug 18, 2020 | Nov 17, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 16, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub