An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-fpmUpgrade php-xmlrpcUpgrade php-soapUpgrade php-pecl-zipUpgrade php-pearUpgrade php-mbstringUpgrade onigurumaUpgrade php-jsonUpgrade php-pecl-apcu-develUpgrade php-gmpUpgrade php-commonUpgrade php-pecl-rrdUpgrade php-pecl-xdebugUpgrade php-pgsqlUpgrade php-pdoUpgrade php-odbcUpgrade php-develUpgrade php-processUpgrade phpUpgrade php-pecl-apcuUpgrade php-dbgUpgrade php-opcacheUpgrade php-ldapUpgrade php-enchantUpgrade php-snmpUpgrade php-dbaUpgrade php-cliUpgrade libzipUpgrade php-bcmathUpgrade php-mysqlndUpgrade libzip-toolsUpgrade php-intlUpgrade php-embeddedUpgrade libzip-develUpgrade php-xmlUpgrade php-gdUpgrade oniguruma-develUpgrade apcu-panelUpgrade php-recode | May 4, 2022 | Nov 21, 2019 |
| Alpine Linux | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade php-ldapUpgrade php-embeddedUpgrade php-gdUpgrade php-develUpgrade php-recodeUpgrade php-pspellUpgrade php-fpmUpgrade php-enchantUpgrade php-soapUpgrade phpUpgrade php-bcmathUpgrade php-pdoUpgrade php-pgsqlUpgrade php-odbcUpgrade php-cliUpgrade php-xmlUpgrade php-debuginfoUpgrade php-dbaUpgrade php-xmlrpcUpgrade php-processUpgrade php-intlUpgrade php-mbstringUpgrade php-commonUpgrade php-snmpUpgrade php-mysqlnd | Apr 25, 2025 | Nov 21, 2019 |
| Centos_linux | — | Upgrade php-json-debuginfoUpgrade php-pecl-apcuUpgrade php-mbstring-debuginfoUpgrade php-xml-debuginfoUpgrade php-common-debuginfoUpgrade php-soap-debuginfoUpgrade php-cli-debuginfoUpgrade php-odbcUpgrade php-odbc-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-commonUpgrade php-mysqlnd-debuginfoUpgrade php-process-debuginfoUpgrade php-dbgUpgrade php-fpm-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pgsqlUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade libzip-debuginfoUpgrade apcu-panelUpgrade php-pecl-xdebug-debugsourceUpgrade php-debuginfoUpgrade php-enchant-debuginfoUpgrade php-intlUpgrade php-opcache-debuginfoUpgrade php-dba-debuginfoUpgrade php-ldapUpgrade php-fpmUpgrade libzip-develUpgrade php-dbg-debuginfoUpgrade php-recode-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-bcmathUpgrade php-mbstringUpgrade php-pecl-rrd-debuginfoUpgrade php-recodeUpgrade php-enchantUpgrade php-jsonUpgrade libzip-tools-debuginfoUpgrade php-dbaUpgrade php-mysqlndUpgrade phpUpgrade php-pearUpgrade php-cliUpgrade libzip-toolsUpgrade php-ldap-debuginfoUpgrade libzipUpgrade php-bcmath-debuginfoUpgrade php-gmpUpgrade php-pdoUpgrade php-snmpUpgrade libzip-debugsourceUpgrade php-soapUpgrade php-pecl-apcu-debuginfoUpgrade php-processUpgrade php-xmlrpc-debuginfoUpgrade php-gd-debuginfoUpgrade php-gmp-debuginfoUpgrade php-pecl-rrdUpgrade php-snmp-debuginfoUpgrade php-gdUpgrade php-xmlUpgrade php-intl-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-xmlrpcUpgrade php-pecl-xdebugUpgrade php-pecl-apcu-develUpgrade php-debugsourceUpgrade php-pecl-zipUpgrade php-embeddedUpgrade php-opcacheUpgrade php-embedded-debuginfoUpgrade php-devel | Sep 9, 2020 | Nov 21, 2019 |
| Debian | — | Upgrade libonig | Nov 6, 2020 | Nov 21, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-xmlUpgrade php-processUpgrade php-cliUpgrade php-mysqlUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-gdUpgrade php-pdoUpgrade php-pgsqlUpgrade php-ldapUpgrade php-soapUpgrade php-commonUpgrade php-odbcUpgrade php | Oct 26, 2021 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.4-11.4.17.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 21, 2019 |
| Oracle_linux | — | Upgrade php-gmpUpgrade php-mbstringUpgrade php-pdoUpgrade php-develUpgrade php-pecl-apcu-develUpgrade php-gdUpgrade php-fpmUpgrade php-processUpgrade php-cliUpgrade php-pecl-rrdUpgrade onigurumaUpgrade php-xmlUpgrade php-jsonUpgrade php-pecl-xdebugUpgrade php-pearUpgrade php-xmlrpcUpgrade php-recodeUpgrade apcu-panelUpgrade php-embeddedUpgrade libzip-develUpgrade php-mysqlndUpgrade php-dbgUpgrade php-pgsqlUpgrade phpUpgrade php-intlUpgrade php-ldapUpgrade php-commonUpgrade php-pecl-zipUpgrade oniguruma-develUpgrade php-enchantUpgrade php-soapUpgrade php-opcacheUpgrade libzipUpgrade php-dbaUpgrade php-pecl-apcuUpgrade php-odbcUpgrade php-snmpUpgrade libzip-toolsUpgrade php-bcmath | Sep 10, 2020 | Nov 6, 2019 |
| Redhat_linux | — | Upgrade php-xmlrpc-debuginfoUpgrade apcu-panelUpgrade libzip-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pdoUpgrade libzip-develUpgrade php-mysqlndUpgrade php-develUpgrade php-jsonUpgrade php-embeddedUpgrade php-json-debuginfoUpgrade php-gd-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-common-debuginfoNo solution existsUpgrade php-process-debuginfoUpgrade php-dba-debuginfoUpgrade oniguruma-debuginfoUpgrade php-embedded-debuginfoUpgrade php-intlUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-apcuUpgrade php-pecl-zipUpgrade php-pecl-apcu-debugsourceUpgrade php-gmp-debuginfoUpgrade php-enchant-debuginfoUpgrade libzipUpgrade php-gmpUpgrade php-fpm-debuginfoUpgrade php-pgsql-debuginfoUpgrade phpUpgrade php-bcmathUpgrade php-bcmath-debuginfoUpgrade php-cli-debuginfoUpgrade php-enchantUpgrade php-dbgUpgrade php-commonUpgrade php-debugsourceUpgrade php-ldapUpgrade php-mbstring-debuginfoUpgrade php-opcacheUpgrade php-xml-debuginfoUpgrade php-odbcUpgrade php-pgsqlUpgrade oniguruma-develUpgrade php-pecl-apcu-develUpgrade php-pecl-zip-debugsourceUpgrade php-cliUpgrade php-snmp-debuginfoUpgrade libzip-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-dbaUpgrade onigurumaUpgrade php-pecl-xdebugUpgrade php-snmpUpgrade php-recode-debuginfoUpgrade oniguruma-debugsourceUpgrade php-xmlUpgrade php-soap-debuginfoUpgrade php-ldap-debuginfoUpgrade php-dbg-debuginfoUpgrade php-processUpgrade php-gdUpgrade php-opcache-debuginfoUpgrade php-soapUpgrade php-pecl-rrdUpgrade php-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pearUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-mysqlnd-debuginfoUpgrade php-mbstringUpgrade php-odbc-debuginfoUpgrade php-intl-debuginfoUpgrade php-fpmUpgrade php-pecl-apcu-debuginfoUpgrade libzip-tools | Sep 9, 2020 | Nov 21, 2019 |
| Rocky_linux | — | Upgrade php-pecl-zipUpgrade php-pecl-apcu-debugsourceUpgrade libzip-debuginfoUpgrade php-xml-debuginfoUpgrade php-gd-debuginfoUpgrade php-debuginfoUpgrade libzip-toolsUpgrade php-odbc-debuginfoUpgrade phpUpgrade php-gmp-debuginfoUpgrade php-common-debuginfoUpgrade php-pgsqlUpgrade php-dba-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-cli-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-process-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade libzip-debugsourceUpgrade php-intlUpgrade php-ldap-debuginfoUpgrade php-pdo-debuginfoUpgrade libzipUpgrade php-soap-debuginfoUpgrade php-pecl-apcu-develUpgrade php-odbcUpgrade php-soapUpgrade php-dbaUpgrade php-dbgUpgrade php-bcmath-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-ldapUpgrade php-pecl-xdebug-debugsourceUpgrade php-snmp-debuginfoUpgrade php-commonUpgrade php-json-debuginfoUpgrade php-opcache-debuginfoUpgrade php-embedded-debuginfoUpgrade php-pdoUpgrade php-fpmUpgrade php-gmpUpgrade php-recodeUpgrade php-pecl-rrdUpgrade php-intl-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-embeddedUpgrade libzip-develUpgrade php-enchant-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-xmlUpgrade php-bcmathUpgrade php-debugsourceUpgrade php-gdUpgrade php-recode-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-opcacheUpgrade php-processUpgrade php-pecl-xdebugUpgrade php-jsonUpgrade php-xmlrpcUpgrade php-mysqlndUpgrade php-develUpgrade php-enchantUpgrade php-mysqlnd-debuginfoUpgrade php-cliUpgrade php-snmpUpgrade php-dbg-debuginfoUpgrade php-mbstringUpgrade php-pecl-apcu | Mar 12, 2024 | Nov 21, 2019 |
| Suse | — | Upgrade libonig4Upgrade oniguruma-devel | Aug 9, 2024 | Nov 21, 2019 |
| Ubuntu | — | Upgrade libonig4 (Ubuntu Pro)Upgrade libonig2 (Ubuntu Pro) | Mar 22, 2023 | Nov 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub