An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-dbgUpgrade php-recodeUpgrade libzip-toolsUpgrade php-intlUpgrade php-pecl-apcuUpgrade php-gdUpgrade php-embeddedUpgrade phpUpgrade oniguruma-develUpgrade php-opcacheUpgrade php-xmlUpgrade libzip-develUpgrade php-mysqlndUpgrade apcu-panelUpgrade php-bcmathUpgrade php-ldapUpgrade php-cliUpgrade php-enchantUpgrade php-dbaUpgrade libzipUpgrade php-snmpUpgrade php-develUpgrade onigurumaUpgrade php-soapUpgrade php-gmpUpgrade php-pecl-xdebugUpgrade php-processUpgrade php-pecl-rrdUpgrade php-pearUpgrade php-mbstringUpgrade php-fpmUpgrade php-commonUpgrade php-pecl-zipUpgrade php-jsonUpgrade php-pdoUpgrade php-pecl-apcu-develUpgrade php-pgsqlUpgrade php-odbcUpgrade php-xmlrpc | May 4, 2022 | Nov 21, 2019 |
| Alpine Linux | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade php-mbstringUpgrade php-xmlrpcUpgrade php-processUpgrade php-dbaUpgrade php-debuginfoUpgrade php-cliUpgrade php-pgsqlUpgrade php-commonUpgrade php-odbcUpgrade php-mysqlndUpgrade php-snmpUpgrade php-xmlUpgrade php-intlUpgrade php-soapUpgrade php-recodeUpgrade phpUpgrade php-bcmathUpgrade php-embeddedUpgrade php-fpmUpgrade php-ldapUpgrade php-pdoUpgrade php-gdUpgrade php-develUpgrade php-enchantUpgrade php-pspell | Apr 25, 2025 | Nov 21, 2019 |
| Centos_linux | — | Upgrade php-embedded-debuginfoUpgrade php-opcacheUpgrade php-debugsourceUpgrade php-recode-debuginfoUpgrade php-dbg-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-mbstringUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-snmp-debuginfoUpgrade libzip-develUpgrade php-pecl-zipUpgrade php-pecl-xdebugUpgrade php-pecl-apcu-develUpgrade php-pecl-rrdUpgrade php-pecl-rrd-debuginfoUpgrade php-recodeUpgrade php-develUpgrade php-embeddedUpgrade libzip-debugsourceUpgrade php-gd-debuginfoUpgrade php-gmp-debuginfoUpgrade php-soapUpgrade php-processUpgrade php-dbaUpgrade php-intl-debuginfoUpgrade php-enchantUpgrade php-mysqlndUpgrade php-gdUpgrade php-jsonUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-pearUpgrade php-snmpUpgrade php-fpmUpgrade phpUpgrade php-bcmath-debuginfoUpgrade libzip-toolsUpgrade php-gmpUpgrade libzip-tools-debuginfoUpgrade php-cliUpgrade php-ldap-debuginfoUpgrade php-bcmathUpgrade php-pdoUpgrade libzipUpgrade php-pgsql-debuginfoUpgrade apcu-panelUpgrade php-soap-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-common-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-opcache-debuginfoUpgrade php-pdo-debuginfoUpgrade php-enchant-debuginfoUpgrade php-dbgUpgrade php-pecl-zip-debugsourceUpgrade php-dba-debuginfoUpgrade php-fpm-debuginfoUpgrade php-cli-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcuUpgrade php-xml-debuginfoUpgrade php-pgsqlUpgrade libzip-debuginfoUpgrade php-process-debuginfoUpgrade php-odbc-debuginfoUpgrade php-json-debuginfoUpgrade php-commonUpgrade php-ldapUpgrade php-intlUpgrade php-odbcUpgrade php-pecl-xdebug-debugsourceUpgrade php-mbstring-debuginfo | Sep 9, 2020 | Nov 21, 2019 |
| Debian | — | Upgrade libonig | Nov 6, 2020 | Nov 21, 2019 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-xmlrpcUpgrade php-cliUpgrade php-processUpgrade php-gdUpgrade php-pdoUpgrade php-recodeUpgrade php-xmlUpgrade php-mysqlUpgrade php-odbcUpgrade php-soapUpgrade php-commonUpgrade phpUpgrade php-pgsqlUpgrade php-ldap | Oct 26, 2021 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade oniguruma | Jan 3, 2020 | Nov 21, 2019 |
| Oracle Solaris | — | Upgrade library/oniguruma to version 6.9.4-11.4.17.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 21, 2019 |
| Oracle_linux | — | Upgrade php-mbstringUpgrade php-xmlrpcUpgrade php-jsonUpgrade php-xmlUpgrade php-cliUpgrade php-processUpgrade php-pdoUpgrade php-pecl-xdebugUpgrade php-pearUpgrade php-gmpUpgrade onigurumaUpgrade php-pecl-rrdUpgrade php-fpmUpgrade php-pecl-apcu-develUpgrade php-develUpgrade php-gdUpgrade php-pecl-zipUpgrade php-bcmathUpgrade php-intlUpgrade php-recodeUpgrade oniguruma-develUpgrade php-pgsqlUpgrade php-embeddedUpgrade libzip-develUpgrade phpUpgrade php-mysqlndUpgrade php-snmpUpgrade libzip-toolsUpgrade php-dbgUpgrade php-ldapUpgrade php-enchantUpgrade php-dbaUpgrade php-pecl-apcuUpgrade libzipUpgrade php-opcacheUpgrade php-soapUpgrade php-commonUpgrade apcu-panelUpgrade php-odbc | Sep 10, 2020 | Nov 6, 2019 |
| Redhat_linux | — | Upgrade php-xmlUpgrade php-pearUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-debuginfoUpgrade php-snmpUpgrade php-odbc-debuginfoUpgrade php-pecl-apcu-develUpgrade php-cliUpgrade php-gdUpgrade onigurumaUpgrade php-snmp-debuginfoUpgrade libzip-toolsUpgrade oniguruma-debugsourceUpgrade php-pecl-zip-debugsourceUpgrade php-soapUpgrade php-mbstringUpgrade libzip-tools-debuginfoUpgrade php-dbg-debuginfoUpgrade php-xmlrpcUpgrade php-ldap-debuginfoUpgrade php-dbaUpgrade php-pecl-xdebugUpgrade php-pecl-rrdUpgrade php-soap-debuginfoUpgrade php-processUpgrade php-recode-debuginfoUpgrade libzip-debugsourceUpgrade php-fpmUpgrade php-intl-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-opcache-debuginfoUpgrade php-recodeUpgrade php-enchantUpgrade apcu-panelUpgrade php-pecl-xdebug-debugsourceUpgrade php-gmpUpgrade php-bcmath-debuginfoUpgrade libzipUpgrade php-pgsql-debuginfoUpgrade php-dbgUpgrade php-cli-debuginfoUpgrade php-develUpgrade php-gmp-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-bcmathUpgrade oniguruma-develUpgrade php-intlUpgrade php-fpm-debuginfoUpgrade libzip-debuginfoUpgrade php-dba-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-enchant-debuginfoUpgrade php-pgsqlUpgrade php-jsonUpgrade php-process-debuginfoUpgrade php-opcacheUpgrade php-pecl-xdebug-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-gd-debuginfoUpgrade php-common-debuginfoUpgrade libzip-develUpgrade php-pecl-zipUpgrade oniguruma-debuginfoUpgrade php-pdoUpgrade php-pecl-apcuUpgrade php-debugsourceUpgrade php-pecl-rrd-debugsourceUpgrade php-odbcUpgrade php-pecl-zip-debuginfoUpgrade php-commonUpgrade php-pdo-debuginfoUpgrade php-ldapUpgrade php-embedded-debuginfoUpgrade php-xml-debuginfoUpgrade php-mysqlndUpgrade php-embeddedUpgrade phpUpgrade php-json-debuginfoNo solution exists | Sep 9, 2020 | Nov 21, 2019 |
| Rocky_linux | — | Upgrade php-pecl-apcu-debuginfoUpgrade php-opcache-debuginfoUpgrade php-embedded-debuginfoUpgrade php-enchantUpgrade php-jsonUpgrade php-pecl-rrdUpgrade php-develUpgrade php-pecl-rrd-debugsourceUpgrade php-recodeUpgrade php-gdUpgrade php-intl-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-recode-debuginfoUpgrade php-cliUpgrade php-bcmathUpgrade php-xmlrpcUpgrade php-pecl-apcuUpgrade php-snmpUpgrade php-mbstringUpgrade php-dbg-debuginfoUpgrade php-gmpUpgrade php-debugsourceUpgrade php-pecl-xdebugUpgrade php-processUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-mysqlndUpgrade php-pecl-rrd-debuginfoUpgrade php-fpmUpgrade php-xmlUpgrade php-mysqlnd-debuginfoUpgrade php-embeddedUpgrade libzip-develUpgrade php-pdoUpgrade php-opcacheUpgrade php-enchant-debuginfoUpgrade php-xml-debuginfoUpgrade php-gd-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade libzip-toolsUpgrade php-mbstring-debuginfoUpgrade php-soapUpgrade php-bcmath-debuginfoUpgrade php-ldap-debuginfoUpgrade php-ldapUpgrade php-intlUpgrade php-dbaUpgrade php-snmp-debuginfoUpgrade php-odbcUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-json-debuginfoUpgrade libzip-debuginfoUpgrade php-gmp-debuginfoUpgrade phpUpgrade php-odbc-debuginfoUpgrade php-common-debuginfoUpgrade php-debuginfoUpgrade php-cli-debuginfoUpgrade php-process-debuginfoUpgrade php-dba-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pecl-zipUpgrade libzip-tools-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pgsqlUpgrade php-commonUpgrade php-soap-debuginfoUpgrade php-pecl-apcu-develUpgrade libzip-debugsourceUpgrade libzipUpgrade php-pdo-debuginfoUpgrade php-dbg | Mar 12, 2024 | Nov 21, 2019 |
| Suse | — | Upgrade libonig4Upgrade oniguruma-devel | Aug 9, 2024 | Nov 21, 2019 |
| Ubuntu | — | Upgrade libonig4 (Ubuntu Pro)Upgrade libonig2 (Ubuntu Pro) | Mar 22, 2023 | Nov 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub