Published: 21/11/2019 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

An issue exists in Oniguruma 6.x prior to 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oniguruma project oniguruma 6.9.4
oniguruma project oniguruma
debian debian linux 8.0
fedoraproject fedora 30
fedoraproject fedora 31

Debian Bug report logs - #945313 libonig: CVE-2019-19204: heap-buffer-overflow in fetch_interval_quantifier due to double PFETCH Package: src:libonig; Maintainer for src:libonig is Jörg Frings-Fürst <debian@jffemail>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 22 Nov 2019 20:03:01 UTC Severit ...

Synopsis Moderate: rh-php73-php security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for rh-php73-php is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerabilit ...

Synopsis Moderate: php:73 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for the php:73 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability ...

Synopsis Moderate: oniguruma security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for oniguruma is now available for Red Hat Enterprise Linux 88 Extended Update SupportRed Hat Product Security has ra ...

Synopsis Moderate: oniguruma security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for oniguruma is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Security has ra ...

Oniguruma before 693 allows Stack Exhaustion in regcompc because of recursion in regparsec (CVE-2019-16163) Oniguruma through 693, as used in PHP 73x and other products, has a heap-based buffer over-read in str_lower_case_match in regexecc(CVE-2019-19246) ...

Heap-buffer-overflow in Oniguruma (function fetch_interval_quantifier)

CVE-2019-19204 An issue was discovered in Oniguruma 6x before 694_rc2 In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparsec, PFETCH is called without checking PEND This leads to a heap-based buffer over-read Researcher: ManhND of The Tarantula Team, VinCSS (a member of Vingroup) What is Oniguruma Oniguruma by K Kosako is a BSD

Heap-buffer-overflow in Oniguruma (function fetch_interval_quantifier)

CVE-2019-19204 An issue was discovered in Oniguruma 6x before 694_rc2 In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparsec, PFETCH is called without checking PEND This leads to a heap-based buffer over-read Researcher: ManhND of The Tarantula Team, VinCSS (a member of Vingroup) What is Oniguruma Oniguruma by K Kosako is a BSD

CWE-125 https://github.com/kkos/oniguruma/issues/162 https://github.com/kkos/oniguruma/releases/tag/v6.9.4_rc2 https://github.com/ManhNDd/CVE-2019-19204 https://lists.debian.org/debian-lts-announce/2019/12/msg00002.html https://github.com/tarantula-team/CVE-2019-19204 https://usn.ubuntu.com/4460-1/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NO267PLHGYZSWX3XTRPKYBKD4J3YOU5V/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3MBNW6Z4DOXSCNWGBLQ7OA3OGUJ44WL/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=945313 https://nvd.nist.gov https://github.com/ManhNDd/CVE-2019-19204 https://alas.aws.amazon.com/AL2/ALAS-2020-1380.html

CVE-2019-19204

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect