An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-develUpgrade php-xmlrpcUpgrade php-processUpgrade php-mbstringUpgrade php-pecl-xdebugUpgrade php-odbcUpgrade php-gmpUpgrade php-fpmUpgrade php-pdoUpgrade php-pecl-apcu-develUpgrade onigurumaUpgrade php-pgsqlUpgrade php-pecl-rrdUpgrade php-pearUpgrade php-pecl-zipUpgrade php-soapUpgrade php-commonUpgrade php-jsonUpgrade oniguruma-develUpgrade php-enchantUpgrade php-dbaUpgrade phpUpgrade libzip-develUpgrade php-mysqlndUpgrade php-gdUpgrade php-pecl-apcuUpgrade libzip-toolsUpgrade php-dbgUpgrade php-ldapUpgrade apcu-panelUpgrade php-snmpUpgrade php-intlUpgrade php-xmlUpgrade php-embeddedUpgrade php-cliUpgrade libzipUpgrade php-opcacheUpgrade php-recodeUpgrade php-bcmath | May 4, 2022 | Nov 21, 2019 |
| Alpine Linux | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade php-dbaUpgrade php-debuginfoUpgrade php-snmpUpgrade php-processUpgrade php-odbcUpgrade php-mysqlndUpgrade php-commonUpgrade php-cliUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-mbstringUpgrade php-intlUpgrade php-soapUpgrade php-recodeUpgrade phpUpgrade php-pspellUpgrade php-embeddedUpgrade php-fpmUpgrade php-ldapUpgrade php-gdUpgrade php-develUpgrade php-bcmathUpgrade php-enchantUpgrade php-pdo | Apr 25, 2025 | Nov 21, 2019 |
| Centos_linux | — | Upgrade php-mysqlnd-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-json-debuginfoUpgrade php-odbc-debuginfoUpgrade php-opcache-debuginfoUpgrade php-cli-debuginfoUpgrade php-dbgUpgrade php-ldapUpgrade php-commonUpgrade php-mbstring-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-soap-debuginfoUpgrade php-fpm-debuginfoUpgrade php-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-common-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-odbcUpgrade php-xml-debuginfoUpgrade php-pdo-debuginfoUpgrade php-dba-debuginfoUpgrade libzip-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-apcuUpgrade apcu-panelUpgrade php-pecl-xdebug-debugsourceUpgrade php-enchant-debuginfoUpgrade php-intlUpgrade php-pgsqlUpgrade php-soapUpgrade php-cliUpgrade php-processUpgrade libzipUpgrade php-gdUpgrade php-xmlrpcUpgrade php-pearUpgrade phpUpgrade php-pdoUpgrade php-pecl-apcu-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-dbg-debuginfoUpgrade php-recode-debuginfoUpgrade php-mbstringUpgrade php-pecl-rrd-debugsourceUpgrade php-bcmathUpgrade php-opcacheUpgrade libzip-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-recodeUpgrade php-snmp-debuginfoUpgrade libzip-toolsUpgrade php-snmpUpgrade php-fpmUpgrade php-develUpgrade php-embedded-debuginfoUpgrade php-gmp-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-rrdUpgrade libzip-tools-debuginfoUpgrade php-jsonUpgrade php-pgsql-debuginfoUpgrade php-mysqlndUpgrade php-xmlUpgrade libzip-develUpgrade php-enchantUpgrade php-intl-debuginfoUpgrade php-ldap-debuginfoUpgrade php-embeddedUpgrade php-gmpUpgrade php-gd-debuginfoUpgrade php-pecl-apcu-develUpgrade php-debugsourceUpgrade php-pecl-xdebugUpgrade php-pecl-zipUpgrade php-dba | Sep 9, 2020 | Nov 21, 2019 |
| Debian | — | Upgrade libonig | Nov 6, 2020 | Nov 21, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Huawei Euleros 2_0_sp3 | — | Upgrade phpUpgrade php-pgsqlUpgrade php-ldapUpgrade php-odbcUpgrade php-commonUpgrade php-soapUpgrade php-mysqlUpgrade php-xmlUpgrade php-pdoUpgrade php-gdUpgrade php-processUpgrade php-cliUpgrade php-xmlrpcUpgrade php-recode | Oct 26, 2021 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.4-11.4.17.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 21, 2019 |
| Oracle_linux | — | Upgrade php-bcmathUpgrade php-intlUpgrade php-pecl-apcuUpgrade php-recodeUpgrade php-pgsqlUpgrade libzip-toolsUpgrade php-pecl-zipUpgrade php-opcacheUpgrade php-odbcUpgrade php-snmpUpgrade php-soapUpgrade php-enchantUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-dbaUpgrade php-commonUpgrade libzipUpgrade apcu-panelUpgrade php-ldapUpgrade php-dbgUpgrade oniguruma-develUpgrade libzip-develUpgrade phpUpgrade php-pecl-apcu-develUpgrade php-pdoUpgrade php-pearUpgrade php-xmlrpcUpgrade php-gdUpgrade php-fpmUpgrade php-pecl-rrdUpgrade php-mbstringUpgrade php-gmpUpgrade php-develUpgrade php-xmlUpgrade php-jsonUpgrade onigurumaUpgrade php-cliUpgrade php-processUpgrade php-pecl-xdebug | Sep 10, 2020 | Nov 6, 2019 |
| Redhat_linux | — | Upgrade libzip-develUpgrade php-mbstring-debuginfoUpgrade php-enchant-debuginfoUpgrade php-jsonUpgrade oniguruma-debuginfoUpgrade php-gmp-debuginfoUpgrade php-odbcUpgrade php-fpm-debuginfoUpgrade oniguruma-develUpgrade php-develUpgrade php-pecl-xdebug-debugsourceUpgrade php-pdo-debuginfoUpgrade libzip-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-xml-debuginfoUpgrade phpUpgrade php-dbgNo solution existsUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-rrd-debugsourceUpgrade php-pgsqlUpgrade php-pecl-zip-debuginfoUpgrade php-gd-debuginfoUpgrade php-bcmathUpgrade php-gmpUpgrade php-mysqlndUpgrade apcu-panelUpgrade php-enchantUpgrade php-cli-debuginfoUpgrade php-ldapUpgrade php-embedded-debuginfoUpgrade php-pecl-apcuUpgrade php-pdoUpgrade php-pecl-zipUpgrade libzipUpgrade php-intlUpgrade php-pecl-xdebug-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-opcacheUpgrade php-process-debuginfoUpgrade php-dba-debuginfoUpgrade php-common-debuginfoUpgrade php-debugsourceUpgrade php-json-debuginfoUpgrade php-embeddedUpgrade php-commonUpgrade php-pgsql-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-apcu-develUpgrade php-mysqlnd-debuginfoUpgrade oniguruma-debugsourceUpgrade php-soap-debuginfoUpgrade php-cliUpgrade libzip-debugsourceUpgrade php-gdUpgrade php-dbg-debuginfoUpgrade onigurumaUpgrade php-odbc-debuginfoUpgrade php-pecl-rrdUpgrade php-processUpgrade php-soapUpgrade php-ldap-debuginfoUpgrade php-recode-debuginfoUpgrade php-recodeUpgrade php-pearUpgrade php-intl-debuginfoUpgrade libzip-toolsUpgrade libzip-tools-debuginfoUpgrade php-fpmUpgrade php-xmlrpcUpgrade php-snmp-debuginfoUpgrade php-xmlUpgrade php-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-mbstringUpgrade php-snmpUpgrade php-dbaUpgrade php-pecl-xdebugUpgrade php-pecl-zip-debugsource | Sep 9, 2020 | Nov 21, 2019 |
| Rocky_linux | — | Upgrade php-gdUpgrade php-intl-debuginfoUpgrade php-pecl-rrdUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-recode-debuginfoUpgrade php-recodeUpgrade php-opcache-debuginfoUpgrade php-xmlrpcUpgrade php-bcmathUpgrade php-pecl-zip-debugsourceUpgrade php-develUpgrade php-jsonUpgrade php-snmpUpgrade php-mbstringUpgrade php-enchantUpgrade php-pecl-apcu-debuginfoUpgrade php-fpmUpgrade php-debugsourceUpgrade php-xmlUpgrade libzip-develUpgrade php-pdoUpgrade php-enchant-debuginfoUpgrade php-embedded-debuginfoUpgrade php-embeddedUpgrade php-pecl-apcuUpgrade php-dbg-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-gmpUpgrade php-processUpgrade php-pecl-xdebugUpgrade php-cliUpgrade php-mysqlnd-debuginfoUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-pecl-rrd-debuginfoUpgrade libzip-toolsUpgrade php-pecl-apcu-debugsourceUpgrade php-gd-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pgsql-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-zipUpgrade php-process-debuginfoUpgrade php-dba-debuginfoUpgrade php-fpm-debuginfoUpgrade php-cli-debuginfoUpgrade php-common-debuginfoUpgrade php-debuginfoUpgrade phpUpgrade php-gmp-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-json-debuginfoUpgrade php-intlUpgrade libzipUpgrade php-soap-debuginfoUpgrade php-pecl-apcu-develUpgrade php-ldap-debuginfoUpgrade libzip-debugsourceUpgrade php-pdo-debuginfoUpgrade php-odbc-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-odbcUpgrade php-mbstring-debuginfoUpgrade php-soapUpgrade php-ldapUpgrade php-dbgUpgrade php-dbaUpgrade php-snmp-debuginfoUpgrade php-commonUpgrade php-pgsql | Mar 12, 2024 | Nov 21, 2019 |
| Suse | — | Upgrade libonig4Upgrade oniguruma-devel | Aug 9, 2024 | Nov 21, 2019 |
| Ubuntu | — | Upgrade libonig4 (Ubuntu Pro)Upgrade libonig2 (Ubuntu Pro) | Mar 22, 2023 | Nov 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub