An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubyUpgrade ruby-develUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade oniguruma-develUpgrade rubygems-develUpgrade rubygem-xmlrpcUpgrade rubygem-net-telnetUpgrade onigurumaUpgrade rubygem-bson-docUpgrade rubygem-test-unitUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-bundler-docUpgrade rubygem-power_assert | Feb 23, 2024 | Nov 17, 2019 |
| Alpine Linux | — | Upgrade oniguruma | Jan 3, 2020 | Nov 17, 2019 |
| Amazon Linux Ami 2 | — | Upgrade oniguruma-develUpgrade oniguruma-debuginfoUpgrade oniguruma | Apr 27, 2020 | Nov 17, 2019 |
| Debian | — | Upgrade libonig | Dec 5, 2019 | Nov 17, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.4-11.4.17.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 17, 2019 |
| Oracle_linux | — | Upgrade rubygem-rdocUpgrade rubygem-bundlerUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-mongoUpgrade rubygem-abrtUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-mysql2-docUpgrade rubygem-bsonUpgrade rubygem-abrt-docUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade oniguruma-develUpgrade rubygem-bundler-docUpgrade rubygem-minitestUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-mongo-docUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-did_you_meanUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade onigurumaUpgrade ruby-libs | Feb 21, 2024 | Nov 8, 2019 |
| Redhat_linux | — | Upgrade rubygem-rakeUpgrade rubygem-mongo-docUpgrade ruby-irbUpgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygem-pg-debuginfoUpgrade oniguruma-debuginfoUpgrade rubygem-bson-docUpgrade ruby-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2-debugsourceUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-abrt-docUpgrade ruby-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-bundler-docUpgrade ruby-docUpgrade ruby-libs-debuginfoUpgrade oniguruma-develUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-pgUpgrade oniguruma-debugsourceUpgrade rubygem-jsonUpgrade rubygem-pg-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-abrtUpgrade rubygem-mongoUpgrade rubygem-bsonUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-opensslUpgrade rubygem-mysql2Upgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-pg-docUpgrade onigurumaUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-rdocNo solution existsUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-bson-debugsourceUpgrade rubygem-minitestUpgrade rubygem-io-console-debuginfo | Jan 26, 2024 | Nov 17, 2019 |
| Rocky_linux | — | Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debugsourceUpgrade ruby-debuginfoUpgrade rubyUpgrade rubygem-opensslUpgrade ruby-develUpgrade rubygem-mysql2Upgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-pgUpgrade rubygem-bigdecimalUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-bson | Jul 31, 2025 | Jul 29, 2025 |
| Ubuntu | — | Upgrade libonig4 (Ubuntu Pro)Upgrade libonig2 (Ubuntu Pro) | Aug 18, 2020 | Nov 17, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 16, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub