7.5
CVSSv3

CVE-2019-16163

Published: 09/09/2019 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 447
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

Oniguruma prior to 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

oniguruma project oniguruma

fedoraproject fedora 29

fedoraproject fedora 30

debian debian linux 8.0

canonical ubuntu linux 14.04

Vendor Advisories

Debian Bug report logs - #939988 libonig: CVE-2019-16163 Package: src:libonig; Maintainer for src:libonig is Jörg Frings-Fürst <debian@jffemail>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 10 Sep 2019 19:48:02 UTC Severity: important Tags: security, upstream Found in version libonig/692-1 ...
Synopsis Moderate: php:73 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for the php:73 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability ...
Synopsis Moderate: oniguruma security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for oniguruma is now available for Red Hat Enterprise Linux 88 Extended Update SupportRed Hat Product Security has ra ...
Synopsis Moderate: oniguruma security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for oniguruma is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Security has ra ...
Oniguruma before 693 allows Stack Exhaustion in regcompc because of recursion in regparsec (CVE-2019-16163) Oniguruma through 693, as used in PHP 73x and other products, has a heap-based buffer over-read in str_lower_case_match in regexecc(CVE-2019-19246) ...