An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oniguruma-develUpgrade apcu-panelUpgrade php-gdUpgrade php-recodeUpgrade php-ldapUpgrade php-intlUpgrade libzip-toolsUpgrade php-bcmathUpgrade phpUpgrade php-opcacheUpgrade php-xmlUpgrade php-embeddedUpgrade php-enchantUpgrade php-dbgUpgrade libzip-develUpgrade php-dbaUpgrade php-mysqlndUpgrade php-cliUpgrade libzipUpgrade php-pecl-apcuUpgrade php-snmpUpgrade php-pearUpgrade php-pecl-zipUpgrade php-mbstringUpgrade php-xmlrpcUpgrade php-jsonUpgrade php-soapUpgrade php-pdoUpgrade php-fpmUpgrade php-gmpUpgrade onigurumaUpgrade php-pecl-rrdUpgrade php-develUpgrade php-pecl-xdebugUpgrade php-commonUpgrade php-processUpgrade php-pgsqlUpgrade php-pecl-apcu-develUpgrade php-odbc | May 4, 2022 | Nov 21, 2019 |
| Alpine Linux | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade php-bcmathUpgrade php-fpmUpgrade php-enchantUpgrade php-recodeUpgrade php-soapUpgrade php-pspellUpgrade phpUpgrade php-embeddedUpgrade php-gdUpgrade php-develUpgrade php-ldapUpgrade php-pdoUpgrade php-xmlUpgrade php-pgsqlUpgrade php-intlUpgrade php-commonUpgrade php-snmpUpgrade php-mysqlndUpgrade php-cliUpgrade php-dbaUpgrade php-mbstringUpgrade php-processUpgrade php-odbcUpgrade php-debuginfoUpgrade php-xmlrpc | Apr 25, 2025 | Nov 21, 2019 |
| Centos_linux | — | Upgrade php-enchant-debuginfoUpgrade php-pgsqlUpgrade php-pdo-debuginfoUpgrade php-dba-debuginfoUpgrade php-cli-debuginfoUpgrade php-process-debuginfoUpgrade libzip-debuginfoUpgrade php-xml-debuginfoUpgrade php-odbc-debuginfoUpgrade php-ldapUpgrade php-pecl-apcuUpgrade php-fpm-debuginfoUpgrade php-commonUpgrade php-pecl-xdebug-debugsourceUpgrade php-json-debuginfoUpgrade php-soap-debuginfoUpgrade php-intlUpgrade php-opcache-debuginfoUpgrade php-common-debuginfoUpgrade apcu-panelUpgrade php-pecl-zip-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-dbgUpgrade php-pecl-zip-debugsourceUpgrade php-odbcUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-debuginfoUpgrade php-processUpgrade libzip-toolsUpgrade php-debugsourceUpgrade php-embeddedUpgrade php-pearUpgrade php-mysqlndUpgrade phpUpgrade php-snmpUpgrade php-gmpUpgrade php-bcmath-debuginfoUpgrade libzipUpgrade php-embedded-debuginfoUpgrade php-opcacheUpgrade php-intl-debuginfoUpgrade php-xmlrpcUpgrade php-gdUpgrade php-xmlrpc-debuginfoUpgrade libzip-tools-debuginfoUpgrade libzip-debugsourceUpgrade php-snmp-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-recodeUpgrade php-soapUpgrade php-gd-debuginfoUpgrade libzip-develUpgrade php-pecl-zipUpgrade php-pecl-apcu-debuginfoUpgrade php-dbaUpgrade php-pecl-xdebugUpgrade php-pecl-apcu-develUpgrade php-cliUpgrade php-mbstringUpgrade php-dbg-debuginfoUpgrade php-recode-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-bcmathUpgrade php-enchantUpgrade php-pdoUpgrade php-ldap-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-jsonUpgrade php-xmlUpgrade php-develUpgrade php-gmp-debuginfoUpgrade php-pecl-rrdUpgrade php-fpm | Sep 9, 2020 | Nov 21, 2019 |
| Debian | — | Upgrade libonig | Nov 6, 2020 | Nov 21, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-soapUpgrade php-commonUpgrade php-pgsqlUpgrade php-ldapUpgrade phpUpgrade php-odbcUpgrade php-cliUpgrade php-processUpgrade php-xmlrpcUpgrade php-mysqlUpgrade php-xmlUpgrade php-pdoUpgrade php-gdUpgrade php-recode | Oct 26, 2021 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.4-11.4.17.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 21, 2019 |
| Oracle_linux | — | Upgrade php-soapUpgrade phpUpgrade php-ldapUpgrade php-mysqlndUpgrade php-embeddedUpgrade libzip-toolsUpgrade php-pecl-apcuUpgrade php-pecl-zipUpgrade oniguruma-develUpgrade apcu-panelUpgrade libzip-develUpgrade php-opcacheUpgrade php-dbgUpgrade php-pgsqlUpgrade php-commonUpgrade php-odbcUpgrade libzipUpgrade php-intlUpgrade php-bcmathUpgrade php-enchantUpgrade php-recodeUpgrade php-dbaUpgrade php-snmpUpgrade php-xmlUpgrade php-gdUpgrade php-pecl-rrdUpgrade onigurumaUpgrade php-jsonUpgrade php-xmlrpcUpgrade php-pearUpgrade php-cliUpgrade php-fpmUpgrade php-pecl-xdebugUpgrade php-processUpgrade php-pdoUpgrade php-mbstringUpgrade php-gmpUpgrade php-develUpgrade php-pecl-apcu-devel | Sep 10, 2020 | Nov 6, 2019 |
| Redhat_linux | — | Upgrade php-pecl-zip-debuginfoUpgrade php-cli-debuginfoUpgrade php-odbcNo solution existsUpgrade phpUpgrade oniguruma-debuginfoUpgrade php-pecl-apcuUpgrade php-embeddedUpgrade php-pgsql-debuginfoUpgrade php-fpm-debuginfoUpgrade php-enchantUpgrade php-enchant-debuginfoUpgrade php-bcmathUpgrade php-bcmath-debuginfoUpgrade php-gmp-debuginfoUpgrade libzipUpgrade php-gmpUpgrade php-pecl-zipUpgrade php-pdoUpgrade php-xml-debuginfoUpgrade libzip-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-commonUpgrade php-jsonUpgrade php-opcacheUpgrade apcu-panelUpgrade php-pgsqlUpgrade php-common-debuginfoUpgrade php-dba-debuginfoUpgrade oniguruma-develUpgrade php-develUpgrade php-mbstring-debuginfoUpgrade php-dbgUpgrade libzip-develUpgrade php-gd-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-debugsourceUpgrade php-process-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-json-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-intlUpgrade php-embedded-debuginfoUpgrade php-pdo-debuginfoUpgrade php-mysqlndUpgrade php-ldapUpgrade php-xmlrpcUpgrade php-mbstringUpgrade php-cliUpgrade php-processUpgrade php-xmlUpgrade php-pecl-zip-debugsourceUpgrade php-odbc-debuginfoUpgrade php-pecl-xdebugUpgrade php-pecl-rrd-debuginfoUpgrade libzip-tools-debuginfoUpgrade oniguruma-debugsourceUpgrade php-gdUpgrade php-dbg-debuginfoUpgrade php-soapUpgrade libzip-toolsUpgrade php-debuginfoUpgrade libzip-debugsourceUpgrade php-soap-debuginfoUpgrade onigurumaUpgrade php-intl-debuginfoUpgrade php-pecl-rrdUpgrade php-ldap-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-snmpUpgrade php-recodeUpgrade php-opcache-debuginfoUpgrade php-recode-debuginfoUpgrade php-fpmUpgrade php-snmp-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pearUpgrade php-dba | Sep 9, 2020 | Nov 21, 2019 |
| Rocky_linux | — | Upgrade php-xmlrpc-debuginfoUpgrade php-recode-debuginfoUpgrade php-recodeUpgrade php-opcache-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-mbstringUpgrade php-bcmathUpgrade php-fpmUpgrade php-pecl-zip-debugsourceUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-pecl-apcu-debuginfoUpgrade libzip-develUpgrade php-gmpUpgrade php-embeddedUpgrade php-pecl-apcuUpgrade php-embedded-debuginfoUpgrade php-snmpUpgrade php-enchant-debuginfoUpgrade php-pdoUpgrade php-pecl-xdebugUpgrade php-mysqlndUpgrade php-processUpgrade php-dbg-debuginfoUpgrade php-debugsourceUpgrade php-enchantUpgrade php-pecl-rrdUpgrade php-develUpgrade php-intl-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-opcacheUpgrade php-jsonUpgrade php-pecl-xdebug-debuginfoUpgrade php-cliUpgrade php-gdUpgrade php-pecl-rrd-debugsourceUpgrade php-cli-debuginfoUpgrade php-dba-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-odbc-debuginfoUpgrade php-debuginfoUpgrade php-pecl-apcu-develUpgrade php-ldap-debuginfoUpgrade libzip-debugsourceUpgrade php-soap-debuginfoUpgrade php-pdo-debuginfoUpgrade php-intlUpgrade libzipUpgrade php-gd-debuginfoUpgrade libzip-toolsUpgrade php-pecl-apcu-debugsourceUpgrade php-pgsqlUpgrade php-xml-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-pecl-zipUpgrade libzip-debuginfoUpgrade php-gmp-debuginfoUpgrade phpUpgrade php-common-debuginfoUpgrade php-ldapUpgrade php-mbstring-debuginfoUpgrade php-dbaUpgrade php-commonUpgrade php-bcmath-debuginfoUpgrade php-soapUpgrade php-snmp-debuginfoUpgrade php-odbcUpgrade php-json-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-dbgUpgrade php-process-debuginfoUpgrade php-fpm-debuginfo | Mar 12, 2024 | Nov 21, 2019 |
| Suse | — | Upgrade oniguruma-develUpgrade libonig4 | Aug 9, 2024 | Nov 21, 2019 |
| Ubuntu | — | Upgrade libonig4 (Ubuntu Pro)Upgrade libonig2 (Ubuntu Pro) | Mar 22, 2023 | Nov 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub