4.3
CVSSv2

CVE-2019-13225

Published: 10/07/2019 Updated: 07/11/2023
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8
VMScore: 385
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Vulnerability Summary

A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows malicious users to potentially cause denial of service by providing a crafted regular expression. Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

oniguruma project oniguruma 6.9.2

fedoraproject fedora 29

fedoraproject fedora 30

Vendor Advisories

Debian Bug report logs - #931878 libonig: CVE-2019-13224 CVE-2019-13225 Package: src:libonig; Maintainer for src:libonig is Jörg Frings-Fürst <debian@jffemail>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 11 Jul 2019 19:39:02 UTC Severity: important Tags: pending, security, upstream Found in ...
Synopsis Moderate: oniguruma security update Type/Severity Security Advisory: Moderate Topic An update for oniguruma is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score ...
Synopsis Moderate: php:73 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for the php:73 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability ...
A use-after-free in onig_new_deluxe() in regextc in Oniguruma 692 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe() O ...
A use-after-free in onig_new_deluxe() in regextc in Oniguruma 692 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe() O ...
Impact: Moderate Public Date: 2019-06-27 CWE: CWE-476->CWE-400 Bugzilla: 1728965: CVE-2019-13225 oni ...