An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-gmpUpgrade php-pecl-xdebugUpgrade php-develUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-odbcUpgrade php-pearUpgrade php-pdoUpgrade php-pecl-zipUpgrade onigurumaUpgrade php-pecl-apcu-develUpgrade php-jsonUpgrade php-fpmUpgrade php-commonUpgrade php-pecl-rrdUpgrade php-soapUpgrade php-processUpgrade php-mbstringUpgrade php-gdUpgrade php-pecl-apcuUpgrade php-intlUpgrade libzipUpgrade php-ldapUpgrade php-snmpUpgrade php-bcmathUpgrade php-xmlUpgrade php-mysqlndUpgrade phpUpgrade php-embeddedUpgrade php-dbgUpgrade apcu-panelUpgrade php-recodeUpgrade libzip-toolsUpgrade php-enchantUpgrade php-cliUpgrade php-dbaUpgrade php-opcacheUpgrade oniguruma-develUpgrade libzip-devel | May 4, 2022 | Nov 21, 2019 |
| Alpine Linux | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade php-intlUpgrade php-snmpUpgrade php-mysqlndUpgrade php-commonUpgrade php-odbcUpgrade php-dbaUpgrade php-cliUpgrade php-xmlUpgrade php-processUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-debuginfoUpgrade php-mbstringUpgrade php-embeddedUpgrade php-enchantUpgrade php-pspellUpgrade php-bcmathUpgrade php-pdoUpgrade phpUpgrade php-soapUpgrade php-recodeUpgrade php-ldapUpgrade php-fpmUpgrade php-gdUpgrade php-devel | Apr 25, 2025 | Nov 21, 2019 |
| Centos_linux | — | Upgrade php-dbg-debuginfoUpgrade php-gdUpgrade php-recode-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-bcmathUpgrade php-xmlUpgrade php-jsonUpgrade php-mbstringUpgrade php-enchantUpgrade libzip-develUpgrade php-opcacheUpgrade php-dbaUpgrade php-gmp-debuginfoUpgrade php-soapUpgrade libzip-tools-debuginfoUpgrade php-xmlrpcUpgrade php-pecl-rrd-debugsourceUpgrade php-embedded-debuginfoUpgrade php-intl-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-embeddedUpgrade php-ldap-debuginfoUpgrade libzip-toolsUpgrade php-develUpgrade php-pecl-rrdUpgrade php-snmpUpgrade phpUpgrade php-fpmUpgrade php-mysqlndUpgrade php-recodeUpgrade php-snmp-debuginfoUpgrade php-processUpgrade php-debugsourceUpgrade php-pecl-apcu-develUpgrade php-pecl-xdebugUpgrade php-pecl-rrd-debuginfoUpgrade php-cliUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-zipUpgrade php-pearUpgrade php-bcmath-debuginfoUpgrade php-pdoUpgrade libzipUpgrade php-gmpUpgrade php-gd-debuginfoUpgrade libzip-debugsourceUpgrade php-dbgUpgrade php-dba-debuginfoUpgrade php-pdo-debuginfoUpgrade php-odbcUpgrade php-pecl-zip-debugsourceUpgrade php-debuginfoUpgrade php-enchant-debuginfoUpgrade php-soap-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-cli-debuginfoUpgrade apcu-panelUpgrade php-mbstring-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-common-debuginfoUpgrade php-opcache-debuginfoUpgrade php-commonUpgrade php-pgsqlUpgrade php-json-debuginfoUpgrade php-process-debuginfoUpgrade php-ldapUpgrade php-intlUpgrade php-pecl-apcuUpgrade libzip-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-xml-debuginfoUpgrade php-odbc-debuginfoUpgrade php-fpm-debuginfo | Sep 9, 2020 | Nov 21, 2019 |
| Debian | — | Upgrade libonig | Nov 6, 2020 | Nov 21, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-cliUpgrade php-gdUpgrade php-recodeUpgrade php-xmlrpcUpgrade php-pdoUpgrade php-xmlUpgrade php-mysqlUpgrade php-processUpgrade php-commonUpgrade php-pgsqlUpgrade php-ldapUpgrade phpUpgrade php-soapUpgrade php-odbc | Oct 26, 2021 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.4-11.4.17.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 21, 2019 |
| Oracle_linux | — | Upgrade php-pgsqlUpgrade php-intlUpgrade php-opcacheUpgrade php-commonUpgrade php-soapUpgrade php-snmpUpgrade php-enchantUpgrade libzip-develUpgrade php-odbcUpgrade oniguruma-develUpgrade php-dbaUpgrade php-ldapUpgrade php-embeddedUpgrade apcu-panelUpgrade php-mysqlndUpgrade phpUpgrade php-pecl-apcuUpgrade php-recodeUpgrade php-pecl-zipUpgrade php-bcmathUpgrade libzip-toolsUpgrade libzipUpgrade php-dbgUpgrade php-xmlrpcUpgrade php-pecl-xdebugUpgrade php-jsonUpgrade php-xmlUpgrade php-processUpgrade php-mbstringUpgrade php-gdUpgrade php-develUpgrade php-gmpUpgrade onigurumaUpgrade php-fpmUpgrade php-pecl-rrdUpgrade php-pecl-apcu-develUpgrade php-cliUpgrade php-pearUpgrade php-pdo | Sep 10, 2020 | Nov 6, 2019 |
| Redhat_linux | — | Upgrade php-pecl-apcu-develUpgrade php-pecl-xdebugUpgrade libzip-toolsUpgrade php-gdUpgrade php-processUpgrade php-odbc-debuginfoUpgrade php-soap-debuginfoUpgrade php-opcache-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-fpmUpgrade php-debuginfoUpgrade php-xmlUpgrade php-pecl-zip-debugsourceUpgrade php-intl-debuginfoUpgrade php-pearUpgrade php-recodeUpgrade php-dbg-debuginfoUpgrade php-dbaUpgrade php-snmpUpgrade php-snmp-debuginfoUpgrade oniguruma-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-xmlrpcUpgrade libzip-tools-debuginfoUpgrade php-soapUpgrade php-cliUpgrade php-pecl-rrd-debuginfoUpgrade php-mbstringUpgrade onigurumaUpgrade libzip-debugsourceUpgrade php-recode-debuginfoUpgrade php-pecl-rrdUpgrade php-ldap-debuginfoUpgrade php-odbcUpgrade php-pecl-zip-debuginfoUpgrade php-pdoUpgrade php-embeddedUpgrade libzipUpgrade php-enchant-debuginfoUpgrade php-gmpUpgrade php-enchantUpgrade php-fpm-debuginfoUpgrade php-cli-debuginfoUpgrade php-bcmathUpgrade oniguruma-develUpgrade php-process-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade libzip-develUpgrade php-pgsqlUpgrade php-common-debuginfoUpgrade php-dbgUpgrade php-develUpgrade php-debugsourceUpgrade apcu-panelUpgrade php-mbstring-debuginfoUpgrade libzip-debuginfoUpgrade php-intlUpgrade php-mysqlndUpgrade php-pecl-apcuUpgrade phpUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-commonUpgrade php-ldapUpgrade php-pgsql-debuginfoUpgrade php-jsonUpgrade php-bcmath-debuginfoUpgrade php-pecl-zipUpgrade php-pecl-apcu-debugsourceUpgrade oniguruma-debuginfoUpgrade php-opcacheUpgrade php-dba-debuginfoUpgrade php-gmp-debuginfoUpgrade php-gd-debuginfoNo solution existsUpgrade php-pdo-debuginfoUpgrade php-json-debuginfoUpgrade php-embedded-debuginfoUpgrade php-xml-debuginfo | Sep 9, 2020 | Nov 21, 2019 |
| Rocky_linux | — | Upgrade php-processUpgrade php-mysqlndUpgrade php-cliUpgrade php-debugsourceUpgrade php-opcacheUpgrade php-pecl-xdebugUpgrade php-bcmathUpgrade php-pecl-apcu-debuginfoUpgrade php-xmlrpcUpgrade php-mysqlnd-debuginfoUpgrade php-develUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcuUpgrade php-snmpUpgrade php-mbstringUpgrade php-dbg-debuginfoUpgrade php-gdUpgrade php-fpmUpgrade php-xmlUpgrade php-gmpUpgrade php-pdoUpgrade libzip-develUpgrade php-enchant-debuginfoUpgrade php-embedded-debuginfoUpgrade php-recodeUpgrade php-embeddedUpgrade php-recode-debuginfoUpgrade php-jsonUpgrade php-pecl-rrd-debugsourceUpgrade php-enchantUpgrade php-intl-debuginfoUpgrade php-pecl-rrdUpgrade php-xmlrpc-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-odbc-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-xml-debuginfoUpgrade php-gd-debuginfoUpgrade libzip-tools-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-zipUpgrade php-gmp-debuginfoUpgrade php-debuginfoUpgrade php-common-debuginfoUpgrade phpUpgrade php-pecl-zip-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-ldapUpgrade php-bcmath-debuginfoUpgrade php-soapUpgrade php-snmp-debuginfoUpgrade php-odbcUpgrade php-dbgUpgrade php-dbaUpgrade php-commonUpgrade php-pecl-apcu-debugsourceUpgrade php-pgsqlUpgrade php-intlUpgrade libzip-debugsourceUpgrade php-pecl-apcu-develUpgrade php-pdo-debuginfoUpgrade php-soap-debuginfoUpgrade libzipUpgrade php-ldap-debuginfoUpgrade php-process-debuginfoUpgrade php-dba-debuginfoUpgrade php-cli-debuginfoUpgrade php-fpm-debuginfoUpgrade libzip-tools | Mar 12, 2024 | Nov 21, 2019 |
| Suse | — | Upgrade libonig4Upgrade oniguruma-devel | Aug 9, 2024 | Nov 21, 2019 |
| Ubuntu | — | Upgrade libonig2 (Ubuntu Pro)Upgrade libonig4 (Ubuntu Pro) | Mar 22, 2023 | Nov 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub