An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-dbaUpgrade phpUpgrade php-snmpUpgrade libzip-toolsUpgrade oniguruma-develUpgrade php-bcmathUpgrade php-embeddedUpgrade php-pecl-apcuUpgrade php-recodeUpgrade php-intlUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-gdUpgrade php-xmlUpgrade php-cliUpgrade php-dbgUpgrade apcu-panelUpgrade php-enchantUpgrade php-ldapUpgrade libzipUpgrade libzip-develUpgrade php-processUpgrade php-pecl-zipUpgrade php-soapUpgrade php-pgsqlUpgrade php-fpmUpgrade php-pecl-rrdUpgrade php-pdoUpgrade php-xmlrpcUpgrade php-develUpgrade php-commonUpgrade onigurumaUpgrade php-pecl-xdebugUpgrade php-jsonUpgrade php-mbstringUpgrade php-odbcUpgrade php-pearUpgrade php-gmpUpgrade php-pecl-apcu-devel | May 4, 2022 | Nov 21, 2019 |
| Alpine Linux | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade php-enchantUpgrade php-develUpgrade php-gdUpgrade php-recodeUpgrade php-pdoUpgrade php-fpmUpgrade php-pspellUpgrade php-ldapUpgrade php-bcmathUpgrade php-embeddedUpgrade php-soapUpgrade phpUpgrade php-snmpUpgrade php-cliUpgrade php-mbstringUpgrade php-xmlrpcUpgrade php-dbaUpgrade php-odbcUpgrade php-intlUpgrade php-pgsqlUpgrade php-mysqlndUpgrade php-processUpgrade php-debuginfoUpgrade php-xmlUpgrade php-common | Apr 25, 2025 | Nov 21, 2019 |
| Centos_linux | — | Upgrade php-pecl-zip-debugsourceUpgrade php-fpm-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-opcache-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pgsqlUpgrade php-mysqlnd-debuginfoUpgrade php-cli-debuginfoUpgrade php-dbgUpgrade php-pecl-xdebug-debuginfoUpgrade php-odbc-debuginfoUpgrade php-dba-debuginfoUpgrade php-debuginfoUpgrade php-pdo-debuginfoUpgrade php-xml-debuginfoUpgrade php-enchant-debuginfoUpgrade libzip-debuginfoUpgrade php-commonUpgrade php-ldapUpgrade php-mbstring-debuginfoUpgrade php-common-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-odbcUpgrade php-intlUpgrade apcu-panelUpgrade php-soap-debuginfoUpgrade php-process-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-apcuUpgrade php-xmlrpcUpgrade libzip-toolsUpgrade phpUpgrade php-bcmathUpgrade php-pecl-xdebugUpgrade php-pecl-zipUpgrade php-debugsourceUpgrade php-intl-debuginfoUpgrade php-xmlUpgrade php-pgsql-debuginfoUpgrade php-pearUpgrade php-snmpUpgrade php-ldap-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-gmpUpgrade php-mbstringUpgrade php-pdoUpgrade php-recode-debuginfoUpgrade php-dbg-debuginfoUpgrade libzip-develUpgrade php-dbaUpgrade php-embeddedUpgrade php-processUpgrade libzip-debugsourceUpgrade php-pecl-rrd-debuginfoUpgrade php-recodeUpgrade php-snmp-debuginfoUpgrade php-cliUpgrade php-embedded-debuginfoUpgrade libzipUpgrade php-develUpgrade php-gmp-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-opcacheUpgrade php-pecl-rrdUpgrade php-fpmUpgrade php-soapUpgrade php-mysqlndUpgrade php-jsonUpgrade php-enchantUpgrade libzip-tools-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-gdUpgrade php-pecl-rrd-debugsourceUpgrade php-gd-debuginfoUpgrade php-pecl-apcu-devel | Sep 9, 2020 | Nov 21, 2019 |
| Debian | — | Upgrade libonig | Nov 6, 2020 | Nov 21, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-xmlrpcUpgrade php-cliUpgrade php-processUpgrade php-recodeUpgrade php-xmlUpgrade php-gdUpgrade php-pdoUpgrade php-mysqlUpgrade php-ldapUpgrade php-pgsqlUpgrade phpUpgrade php-soapUpgrade php-commonUpgrade php-odbc | Oct 26, 2021 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.4-11.4.17.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 21, 2019 |
| Oracle_linux | — | Upgrade php-jsonUpgrade php-xmlrpcUpgrade php-pearUpgrade onigurumaUpgrade php-gdUpgrade php-fpmUpgrade php-pecl-apcu-develUpgrade php-pecl-rrdUpgrade php-pdoUpgrade php-pecl-xdebugUpgrade php-processUpgrade php-cliUpgrade php-develUpgrade php-gmpUpgrade php-mbstringUpgrade php-xmlUpgrade libzip-develUpgrade php-embeddedUpgrade libzip-toolsUpgrade apcu-panelUpgrade php-dbgUpgrade php-commonUpgrade php-intlUpgrade php-recodeUpgrade php-bcmathUpgrade libzipUpgrade phpUpgrade oniguruma-develUpgrade php-soapUpgrade php-mysqlndUpgrade php-ldapUpgrade php-dbaUpgrade php-enchantUpgrade php-snmpUpgrade php-odbcUpgrade php-pecl-apcuUpgrade php-pgsqlUpgrade php-pecl-zipUpgrade php-opcache | Sep 10, 2020 | Nov 6, 2019 |
| Redhat_linux | — | Upgrade libzip-debugsourceUpgrade php-odbc-debuginfoUpgrade php-fpmUpgrade php-xmlrpcUpgrade php-pearUpgrade php-dbaUpgrade php-cliUpgrade onigurumaUpgrade php-soap-debuginfoUpgrade php-xmlUpgrade php-opcache-debuginfoUpgrade php-dbg-debuginfoUpgrade oniguruma-debugsourceUpgrade libzip-toolsUpgrade php-pecl-rrdUpgrade php-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-develUpgrade php-pecl-apcu-debuginfoUpgrade php-snmpUpgrade php-gdUpgrade php-processUpgrade php-ldap-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-recode-debuginfoUpgrade php-mbstringUpgrade php-soapUpgrade php-intl-debuginfoUpgrade php-snmp-debuginfoUpgrade php-recodeUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-xdebugUpgrade php-gd-debuginfoUpgrade oniguruma-debuginfoUpgrade php-ldapUpgrade php-embedded-debuginfoUpgrade php-pdo-debuginfoUpgrade php-fpm-debuginfoNo solution existsUpgrade php-pgsql-debuginfoUpgrade php-gmpUpgrade php-cli-debuginfoUpgrade libzipUpgrade php-pecl-xdebug-debuginfoUpgrade libzip-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-enchantUpgrade php-pecl-apcuUpgrade php-json-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-gmp-debuginfoUpgrade php-process-debuginfoUpgrade phpUpgrade php-dba-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-bcmathUpgrade php-pdoUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-intlUpgrade php-pgsqlUpgrade php-common-debuginfoUpgrade php-enchant-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-opcacheUpgrade php-pecl-xdebug-debugsourceUpgrade oniguruma-develUpgrade php-develUpgrade libzip-develUpgrade php-pecl-rrd-debugsourceUpgrade php-odbcUpgrade php-jsonUpgrade php-debugsourceUpgrade apcu-panelUpgrade php-dbgUpgrade php-pecl-zipUpgrade php-common | Sep 9, 2020 | Nov 21, 2019 |
| Rocky_linux | — | Upgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-xml-debuginfoUpgrade php-dba-debuginfoUpgrade php-fpm-debuginfoUpgrade phpUpgrade php-soapUpgrade php-snmp-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-dbaUpgrade php-dbgUpgrade php-ldapUpgrade php-pgsqlUpgrade php-odbcUpgrade php-commonUpgrade libzip-tools-debuginfoUpgrade php-pecl-zipUpgrade php-debuginfoUpgrade php-cli-debuginfoUpgrade php-common-debuginfoUpgrade php-process-debuginfoUpgrade libzipUpgrade libzip-debugsourceUpgrade php-gmp-debuginfoUpgrade php-intlUpgrade php-pecl-apcu-debugsourceUpgrade libzip-toolsUpgrade php-gd-debuginfoUpgrade php-pdo-debuginfoUpgrade php-ldap-debuginfoUpgrade php-odbc-debuginfoUpgrade libzip-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-apcu-develUpgrade php-soap-debuginfoUpgrade php-opcacheUpgrade php-pdoUpgrade php-pecl-apcu-debuginfoUpgrade php-xmlUpgrade php-recode-debuginfoUpgrade php-bcmathUpgrade php-debugsourceUpgrade php-snmpUpgrade php-mbstringUpgrade php-gmpUpgrade php-pecl-apcuUpgrade php-dbg-debuginfoUpgrade php-recodeUpgrade php-gdUpgrade php-opcache-debuginfoUpgrade php-develUpgrade php-jsonUpgrade php-enchantUpgrade php-mysqlnd-debuginfoUpgrade php-cliUpgrade php-pecl-xdebugUpgrade php-processUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-fpmUpgrade php-mysqlndUpgrade php-pecl-zip-debugsourceUpgrade php-enchant-debuginfoUpgrade libzip-develUpgrade php-embedded-debuginfoUpgrade php-embeddedUpgrade php-xmlrpcUpgrade php-intl-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-rrd | Mar 12, 2024 | Nov 21, 2019 |
| Suse | — | Upgrade libonig4Upgrade oniguruma-devel | Aug 9, 2024 | Nov 21, 2019 |
| Ubuntu | — | Upgrade libonig2 (Ubuntu Pro)Upgrade libonig4 (Ubuntu Pro) | Mar 22, 2023 | Nov 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub