Bugzilla – Bug 1142847
VUL-0: CVE-2019-13224: oniguruma: use-after-free in onig_new_deluxe() in regext.c
Last modified: 2022-08-12 07:48:24 UTC
CVE-2019-13224 A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust. Reference: https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55 References: https://bugzilla.redhat.com/show_bug.cgi?id=1728970 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13224 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13224.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13224 https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55 https://lists.debian.org/debian-lts-announce/2019/07/msg00013.html
Created attachment 811602 [details] oniguruma-CVE-2019-13224.patch