An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-develUpgrade php-pearUpgrade php-jsonUpgrade php-soapUpgrade onigurumaUpgrade php-pdoUpgrade php-odbcUpgrade php-gmpUpgrade php-pecl-xdebugUpgrade php-pecl-apcu-develUpgrade php-pgsqlUpgrade php-xmlrpcUpgrade php-pecl-rrdUpgrade php-commonUpgrade php-fpmUpgrade php-mbstringUpgrade php-pecl-zipUpgrade php-processUpgrade libzip-develUpgrade oniguruma-develUpgrade php-gdUpgrade phpUpgrade php-opcacheUpgrade php-bcmathUpgrade php-pecl-apcuUpgrade php-xmlUpgrade php-recodeUpgrade php-intlUpgrade php-dbgUpgrade php-enchantUpgrade php-dbaUpgrade apcu-panelUpgrade libzip-toolsUpgrade php-mysqlndUpgrade php-cliUpgrade php-ldapUpgrade php-snmpUpgrade libzipUpgrade php-embedded | May 4, 2022 | Nov 21, 2019 |
| Alpine Linux | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade php-gdUpgrade phpUpgrade php-recodeUpgrade php-ldapUpgrade php-develUpgrade php-bcmathUpgrade php-soapUpgrade php-embeddedUpgrade php-pdoUpgrade php-enchantUpgrade php-fpmUpgrade php-pspellUpgrade php-cliUpgrade php-mysqlndUpgrade php-xmlUpgrade php-dbaUpgrade php-intlUpgrade php-pgsqlUpgrade php-mbstringUpgrade php-xmlrpcUpgrade php-commonUpgrade php-odbcUpgrade php-snmpUpgrade php-processUpgrade php-debuginfo | Apr 25, 2025 | Nov 21, 2019 |
| Centos_linux | — | Upgrade php-processUpgrade php-pecl-apcu-debuginfoUpgrade php-gd-debuginfoUpgrade libzip-develUpgrade php-mbstringUpgrade php-bcmathUpgrade php-pecl-rrd-debugsourceUpgrade php-gmpUpgrade php-ldap-debuginfoUpgrade libzip-debugsourceUpgrade php-develUpgrade php-xmlrpc-debuginfoUpgrade php-embedded-debuginfoUpgrade php-soapUpgrade libzipUpgrade php-gmp-debuginfoUpgrade libzip-toolsUpgrade php-debugsourceUpgrade php-bcmath-debuginfoUpgrade php-opcacheUpgrade php-pecl-apcu-develUpgrade php-pecl-zipUpgrade php-pecl-rrdUpgrade php-jsonUpgrade php-xmlUpgrade php-intl-debuginfoUpgrade php-pgsql-debuginfoUpgrade phpUpgrade libzip-tools-debuginfoUpgrade php-enchantUpgrade php-gdUpgrade php-fpmUpgrade php-mysqlndUpgrade php-cliUpgrade php-pearUpgrade php-dbaUpgrade php-dbg-debuginfoUpgrade php-snmpUpgrade php-xmlrpcUpgrade php-snmp-debuginfoUpgrade php-pecl-xdebugUpgrade php-pecl-rrd-debuginfoUpgrade php-pdoUpgrade php-recodeUpgrade php-recode-debuginfoUpgrade php-embeddedUpgrade php-fpm-debuginfoUpgrade php-commonUpgrade php-odbc-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pgsqlUpgrade php-dbgUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-pdo-debuginfoUpgrade php-opcache-debuginfoUpgrade php-enchant-debuginfoUpgrade php-common-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-xml-debuginfoUpgrade php-pecl-apcuUpgrade php-pecl-xdebug-debugsourceUpgrade php-cli-debuginfoUpgrade libzip-debuginfoUpgrade php-ldapUpgrade php-debuginfoUpgrade php-json-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-soap-debuginfoUpgrade php-intlUpgrade php-dba-debuginfoUpgrade apcu-panelUpgrade php-odbcUpgrade php-process-debuginfo | Sep 9, 2020 | Nov 21, 2019 |
| Debian | — | Upgrade libonig | Nov 6, 2020 | Nov 21, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-processUpgrade php-cliUpgrade php-recodeUpgrade php-xmlrpcUpgrade php-mysqlUpgrade php-xmlUpgrade php-pdoUpgrade php-gdUpgrade php-commonUpgrade php-soapUpgrade php-ldapUpgrade php-pgsqlUpgrade php-odbcUpgrade php | Oct 26, 2021 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.4-11.4.17.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 21, 2019 |
| Oracle_linux | — | Upgrade php-develUpgrade php-fpmUpgrade php-gdUpgrade php-pecl-rrdUpgrade php-pecl-apcu-develUpgrade php-xmlUpgrade php-processUpgrade php-cliUpgrade php-xmlrpcUpgrade php-pearUpgrade php-pecl-xdebugUpgrade php-jsonUpgrade onigurumaUpgrade php-gmpUpgrade php-mbstringUpgrade php-pdoUpgrade php-snmpUpgrade php-commonUpgrade php-bcmathUpgrade libzipUpgrade php-odbcUpgrade php-dbaUpgrade apcu-panelUpgrade php-embeddedUpgrade php-soapUpgrade php-mysqlndUpgrade php-pgsqlUpgrade phpUpgrade php-pecl-zipUpgrade libzip-toolsUpgrade php-pecl-apcuUpgrade php-opcacheUpgrade php-dbgUpgrade libzip-develUpgrade php-enchantUpgrade oniguruma-develUpgrade php-ldapUpgrade php-intlUpgrade php-recode | Sep 10, 2020 | Nov 6, 2019 |
| Redhat_linux | — | Upgrade php-opcacheUpgrade php-pgsqlUpgrade php-dba-debuginfoUpgrade php-intlUpgrade php-dbgUpgrade php-gmpUpgrade php-mbstring-debuginfoUpgrade libzip-develUpgrade oniguruma-develUpgrade php-pecl-xdebug-debugsourceUpgrade php-jsonUpgrade php-commonUpgrade php-xmlrpc-debuginfoUpgrade php-gd-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-common-debuginfoUpgrade php-json-debuginfoUpgrade php-mysqlndUpgrade php-process-debuginfoUpgrade php-pdo-debuginfoUpgrade php-debugsourceUpgrade oniguruma-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade libzip-debuginfoUpgrade php-odbcUpgrade php-pecl-zip-debuginfoNo solution existsUpgrade php-pdoUpgrade php-pgsql-debuginfoUpgrade php-bcmathUpgrade php-bcmath-debuginfoUpgrade php-enchant-debuginfoUpgrade php-cli-debuginfoUpgrade php-enchantUpgrade libzipUpgrade php-fpm-debuginfoUpgrade php-gmp-debuginfoUpgrade php-develUpgrade apcu-panelUpgrade php-embeddedUpgrade phpUpgrade php-ldapUpgrade php-embedded-debuginfoUpgrade php-pecl-zipUpgrade php-pecl-apcuUpgrade php-pecl-apcu-debugsourceUpgrade php-recode-debuginfoUpgrade php-ldap-debuginfoUpgrade php-gdUpgrade php-soapUpgrade php-opcache-debuginfoUpgrade php-processUpgrade onigurumaUpgrade libzip-tools-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-rrd-debuginfoUpgrade oniguruma-debugsourceUpgrade php-intl-debuginfoUpgrade php-dbg-debuginfoUpgrade php-fpmUpgrade php-pearUpgrade php-xmlrpcUpgrade php-mbstringUpgrade php-pecl-xdebugUpgrade php-snmpUpgrade php-dbaUpgrade php-pecl-zip-debugsourceUpgrade php-soap-debuginfoUpgrade php-xmlUpgrade php-debuginfoUpgrade libzip-debugsourceUpgrade php-recodeUpgrade php-mysqlnd-debuginfoUpgrade libzip-toolsUpgrade php-pecl-apcu-debuginfoUpgrade php-snmp-debuginfoUpgrade php-cliUpgrade php-odbc-debuginfoUpgrade php-pecl-apcu-devel | Sep 9, 2020 | Nov 21, 2019 |
| Rocky_linux | — | Upgrade php-pecl-rrdUpgrade php-snmpUpgrade php-pecl-apcuUpgrade php-recode-debuginfoUpgrade php-xmlUpgrade php-fpmUpgrade php-enchant-debuginfoUpgrade php-recodeUpgrade php-xmlrpcUpgrade php-gmpUpgrade php-gdUpgrade php-mbstringUpgrade php-pecl-rrd-debugsourceUpgrade php-xmlrpc-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-intl-debuginfoUpgrade php-bcmathUpgrade php-debugsourceUpgrade php-dbg-debuginfoUpgrade php-pdoUpgrade php-opcacheUpgrade php-cliUpgrade php-enchantUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-embeddedUpgrade php-embedded-debuginfoUpgrade php-processUpgrade php-mysqlndUpgrade libzip-develUpgrade php-pecl-xdebugUpgrade php-mysqlnd-debuginfoUpgrade php-jsonUpgrade php-develUpgrade php-xml-debuginfoUpgrade php-gmp-debuginfoUpgrade php-gd-debuginfoUpgrade php-json-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-dbaUpgrade php-bcmath-debuginfoUpgrade php-commonUpgrade php-odbcUpgrade php-pgsqlUpgrade php-pgsql-debuginfoUpgrade php-fpm-debuginfoUpgrade libzip-debuginfoUpgrade libzip-toolsUpgrade php-debuginfoUpgrade php-common-debuginfoUpgrade phpUpgrade php-odbc-debuginfoUpgrade php-pecl-zipUpgrade libzip-tools-debuginfoUpgrade php-cli-debuginfoUpgrade php-dba-debuginfoUpgrade libzip-debugsourceUpgrade php-ldap-debuginfoUpgrade php-intlUpgrade libzipUpgrade php-soap-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pdo-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-process-debuginfoUpgrade php-snmp-debuginfoUpgrade php-soapUpgrade php-ldapUpgrade php-dbg | Mar 12, 2024 | Nov 21, 2019 |
| Suse | — | Upgrade libonig4Upgrade oniguruma-devel | Aug 9, 2024 | Nov 21, 2019 |
| Ubuntu | — | Upgrade libonig4 (Ubuntu Pro)Upgrade libonig2 (Ubuntu Pro) | Mar 22, 2023 | Nov 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub