An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pecl-apcu-develUpgrade php-commonUpgrade php-soapUpgrade php-pecl-zipUpgrade php-pecl-xdebugUpgrade onigurumaUpgrade php-processUpgrade php-pecl-rrdUpgrade php-fpmUpgrade php-xmlrpcUpgrade php-pgsqlUpgrade php-develUpgrade php-odbcUpgrade php-pdoUpgrade php-jsonUpgrade php-gmpUpgrade php-pearUpgrade php-mbstringUpgrade php-ldapUpgrade php-enchantUpgrade php-snmpUpgrade php-bcmathUpgrade libzip-develUpgrade phpUpgrade oniguruma-develUpgrade php-gdUpgrade php-recodeUpgrade php-xmlUpgrade php-pecl-apcuUpgrade php-opcacheUpgrade libzip-toolsUpgrade php-intlUpgrade php-dbgUpgrade apcu-panelUpgrade php-cliUpgrade php-dbaUpgrade libzipUpgrade php-embeddedUpgrade php-mysqlnd | May 4, 2022 | Nov 21, 2019 |
| Alpine Linux | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade php-odbcUpgrade php-pgsqlUpgrade php-snmpUpgrade php-intlUpgrade php-mysqlndUpgrade php-xmlUpgrade php-debuginfoUpgrade php-processUpgrade php-dbaUpgrade php-mbstringUpgrade php-cliUpgrade php-commonUpgrade php-xmlrpcUpgrade php-pspellUpgrade php-gdUpgrade php-enchantUpgrade php-develUpgrade php-bcmathUpgrade phpUpgrade php-pdoUpgrade php-recodeUpgrade php-soapUpgrade php-ldapUpgrade php-embeddedUpgrade php-fpm | Apr 25, 2025 | Nov 21, 2019 |
| Centos_linux | — | Upgrade php-recodeUpgrade php-bcmathUpgrade php-recode-debuginfoUpgrade phpUpgrade php-snmp-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade libzip-debugsourceUpgrade php-debugsourceUpgrade php-pecl-apcu-develUpgrade php-ldap-debuginfoUpgrade php-bcmath-debuginfoUpgrade libzipUpgrade php-snmpUpgrade php-gmpUpgrade php-pdoUpgrade libzip-toolsUpgrade php-pecl-zipUpgrade php-pecl-xdebugUpgrade php-pearUpgrade php-pecl-rrd-debugsourceUpgrade php-dbg-debuginfoUpgrade php-xmlrpcUpgrade php-enchantUpgrade php-jsonUpgrade php-pgsql-debuginfoUpgrade php-xmlUpgrade php-gd-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-soapUpgrade php-gdUpgrade php-pecl-apcu-debuginfoUpgrade php-processUpgrade php-intl-debuginfoUpgrade php-mbstringUpgrade php-cliUpgrade php-embedded-debuginfoUpgrade libzip-develUpgrade php-develUpgrade php-opcacheUpgrade php-xmlrpc-debuginfoUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-fpmUpgrade php-gmp-debuginfoUpgrade php-pecl-rrdUpgrade php-dbaUpgrade apcu-panelUpgrade php-pecl-xdebug-debugsourceUpgrade php-cli-debuginfoUpgrade php-dba-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pdo-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-enchant-debuginfoUpgrade php-dbgUpgrade php-intlUpgrade php-json-debuginfoUpgrade php-soap-debuginfoUpgrade libzip-debuginfoUpgrade php-debuginfoUpgrade php-odbc-debuginfoUpgrade php-commonUpgrade php-pecl-apcu-debugsourceUpgrade php-common-debuginfoUpgrade php-pgsqlUpgrade php-pecl-zip-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-mbstring-debuginfoUpgrade php-pecl-apcuUpgrade php-ldapUpgrade php-xml-debuginfoUpgrade php-odbcUpgrade php-process-debuginfo | Sep 9, 2020 | Nov 21, 2019 |
| Debian | — | Upgrade libonig | Nov 6, 2020 | Nov 21, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-ldapUpgrade php-pgsqlUpgrade php-commonUpgrade phpUpgrade php-soapUpgrade php-odbcUpgrade php-xmlUpgrade php-pdoUpgrade php-processUpgrade php-gdUpgrade php-cliUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-mysql | Oct 26, 2021 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.4-11.4.17.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 21, 2019 |
| Oracle_linux | — | Upgrade php-odbcUpgrade php-snmpUpgrade php-enchantUpgrade php-pgsqlUpgrade php-intlUpgrade libzipUpgrade php-dbaUpgrade php-commonUpgrade phpUpgrade oniguruma-develUpgrade php-pecl-apcuUpgrade apcu-panelUpgrade libzip-toolsUpgrade php-bcmathUpgrade php-embeddedUpgrade libzip-develUpgrade php-mysqlndUpgrade php-dbgUpgrade php-soapUpgrade php-ldapUpgrade php-recodeUpgrade php-pecl-zipUpgrade php-opcacheUpgrade php-gmpUpgrade php-develUpgrade php-pdoUpgrade php-fpmUpgrade php-pearUpgrade php-cliUpgrade php-pecl-apcu-develUpgrade php-pecl-rrdUpgrade onigurumaUpgrade php-xmlUpgrade php-jsonUpgrade php-xmlrpcUpgrade php-pecl-xdebugUpgrade php-gdUpgrade php-processUpgrade php-mbstring | Sep 10, 2020 | Nov 6, 2019 |
| Redhat_linux | — | Upgrade onigurumaUpgrade php-soap-debuginfoUpgrade php-snmp-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-cliUpgrade libzip-debugsourceUpgrade php-dbaUpgrade php-recodeUpgrade libzip-toolsUpgrade php-fpmUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-gdUpgrade php-soapUpgrade php-ldap-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pecl-rrdUpgrade php-recode-debuginfoUpgrade php-processUpgrade php-pecl-apcu-develUpgrade php-odbc-debuginfoUpgrade php-dbg-debuginfoUpgrade php-snmpUpgrade php-pecl-xdebugUpgrade php-mbstringUpgrade php-xmlrpcUpgrade php-debuginfoUpgrade libzip-tools-debuginfoUpgrade oniguruma-debugsourceUpgrade php-xmlUpgrade php-intl-debuginfoUpgrade php-pearUpgrade php-embedded-debuginfoUpgrade php-bcmathUpgrade libzipUpgrade php-bcmath-debuginfoUpgrade php-fpm-debuginfoUpgrade php-process-debuginfoUpgrade php-debugsourceUpgrade php-dba-debuginfoUpgrade php-common-debuginfoUpgrade php-pgsqlUpgrade php-mysqlndUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-opcacheUpgrade php-gmpNo solution existsUpgrade php-odbcUpgrade php-pecl-apcu-debugsourceUpgrade php-gd-debuginfoUpgrade php-pdoUpgrade php-json-debuginfoUpgrade php-embeddedUpgrade libzip-debuginfoUpgrade php-jsonUpgrade php-pecl-apcuUpgrade php-intlUpgrade apcu-panelUpgrade php-pecl-xdebug-debugsourceUpgrade php-xml-debuginfoUpgrade php-ldapUpgrade php-mbstring-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-develUpgrade oniguruma-debuginfoUpgrade php-commonUpgrade php-pdo-debuginfoUpgrade php-pecl-zipUpgrade php-dbgUpgrade php-pecl-zip-debuginfoUpgrade libzip-develUpgrade php-enchantUpgrade php-pgsql-debuginfoUpgrade phpUpgrade php-enchant-debuginfoUpgrade php-gmp-debuginfoUpgrade php-cli-debuginfoUpgrade oniguruma-devel | Sep 9, 2020 | Nov 21, 2019 |
| Rocky_linux | — | Upgrade php-embeddedUpgrade php-xmlrpcUpgrade php-enchant-debuginfoUpgrade php-bcmathUpgrade php-pecl-apcu-debuginfoUpgrade php-debugsourceUpgrade php-pecl-zip-debugsourceUpgrade php-embedded-debuginfoUpgrade php-pdoUpgrade libzip-develUpgrade php-fpmUpgrade php-xmlUpgrade php-develUpgrade php-dbg-debuginfoUpgrade php-enchantUpgrade php-xmlrpc-debuginfoUpgrade php-recode-debuginfoUpgrade php-gdUpgrade php-jsonUpgrade php-intl-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pecl-apcuUpgrade php-opcacheUpgrade php-mysqlnd-debuginfoUpgrade php-gmpUpgrade php-pecl-rrd-debuginfoUpgrade php-mysqlndUpgrade php-cliUpgrade php-mbstringUpgrade php-pecl-xdebug-debuginfoUpgrade php-snmpUpgrade php-processUpgrade php-pecl-rrdUpgrade php-pecl-xdebugUpgrade php-pecl-rrd-debugsourceUpgrade php-recodeUpgrade libzip-debuginfoUpgrade php-intlUpgrade php-process-debuginfoUpgrade libzip-toolsUpgrade php-common-debuginfoUpgrade php-gmp-debuginfoUpgrade libzipUpgrade php-pecl-apcu-develUpgrade libzip-debugsourceUpgrade php-soap-debuginfoUpgrade php-pdo-debuginfoUpgrade php-ldap-debuginfoUpgrade php-gd-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-fpm-debuginfoUpgrade php-cli-debuginfoUpgrade php-dba-debuginfoUpgrade php-soapUpgrade php-bcmath-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-ldapUpgrade php-dbgUpgrade php-dbaUpgrade php-commonUpgrade php-snmp-debuginfoUpgrade php-odbcUpgrade php-pgsqlUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-zipUpgrade php-xml-debuginfoUpgrade php-pgsql-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-debuginfoUpgrade php-odbc-debuginfoUpgrade php | Mar 12, 2024 | Nov 21, 2019 |
| Suse | — | Upgrade oniguruma-develUpgrade libonig4 | Aug 9, 2024 | Nov 21, 2019 |
| Ubuntu | — | Upgrade libonig2 (Ubuntu Pro)Upgrade libonig4 (Ubuntu Pro) | Mar 22, 2023 | Nov 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub