CVE-2019-19012
Fixed in a distro release EPSS 11%
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.
Products: oniguruma_project oniguruma, debian_linux, fedoraproject fedora, redhat enterprise_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | oniguruma | 6.8.2-2.1.el8_9 |
| AlmaLinux 8 | oniguruma-devel | 6.8.2-2.1.el8_9 |
| AlmaLinux 8 | ruby | 2.5.9-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | ruby-devel | 2.5.9-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | ruby-doc | 2.5.9-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | ruby-irb | 2.5.9-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | ruby-libs | 2.5.9-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-abrt | 0.3.0-4.module_el8.5.0+2625+ec418553 |
| AlmaLinux 8 | rubygem-abrt-doc | 0.3.0-4.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-bigdecimal | 1.3.4-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-bson | 4.3.0-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux 8 | rubygem-bson | 4.3.0-2.module_el8.6.0+3170+4b08f9d4 |
| AlmaLinux 8 | rubygem-bson | 4.3.0-2.module_el8.5.0+259+8cec6917 |
| AlmaLinux 8 | rubygem-bson-doc | 4.3.0-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux 8 | rubygem-bundler | 1.16.1-5.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-bundler-doc | 1.16.1-5.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-did_you_mean | 1.2.0-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-io-console | 0.4.6-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-json | 2.1.0-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-minitest | 5.10.3-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-mongo | 2.5.1-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux 8 | rubygem-mongo-doc | 2.5.1-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux 8 | rubygem-mysql2 | 0.4.10-4.module_el8.5.0+259+8cec6917 |
| AlmaLinux 8 | rubygem-mysql2 | 0.4.10-4.module_el8.5.0+2625+ec418553 |
| AlmaLinux 8 | rubygem-mysql2 | 0.4.10-4.module_el8.6.0+3170+4b08f9d4 |
| AlmaLinux 8 | rubygem-mysql2-doc | 0.4.10-4.module_el8.5.0+2625+ec418553 |
| AlmaLinux 8 | rubygem-net-telnet | 0.1.1-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-openssl | 2.1.2-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-pg | 1.0.0-3.module_el8.9.0+3635+c6f99506 |
| AlmaLinux 8 | rubygem-pg-doc | 1.0.0-3.module_el8.9.0+3635+c6f99506 |
| AlmaLinux 8 | rubygem-power_assert | 1.1.1-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-psych | 3.0.2-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-rake | 12.3.3-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-rdoc | 6.0.1.1-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-test-unit | 3.2.7-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygem-xmlrpc | 0.3.0-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygems | 2.7.6.3-114.module_el8.10.0+3991+5e651d4e |
| AlmaLinux 8 | rubygems-devel | 2.7.6.3-114.module_el8.10.0+3991+5e651d4e |
| Amazon Linux 2 | oniguruma | 5.9.6-1.amzn2.0.3 |
| Amazon Linux 2 | oniguruma-devel | 5.9.6-1.amzn2.0.3 |
| Debian 12 | libonig | 6.9.4-1 |
| Debian 13 | libonig | 6.9.4-1 |
| Debian 14 | libonig | 6.9.4-1 |
| Debian 8 | libonig | 5.9.5-3.2+deb8u4 |
| Debian 9 | libonig | 6.1.3-2+deb9u1 |
| Red Hat Enterprise Linux 8 | oniguruma | 0:6.8.2-2.1.el8_9 |
| Red Hat Enterprise Linux 8 | oniguruma-debuginfo | 0:6.8.2-2.1.el8_9 |
| Red Hat Enterprise Linux 8 | oniguruma-debugsource | 0:6.8.2-2.1.el8_9 |
| Red Hat Enterprise Linux 8 | oniguruma-devel | 0:6.8.2-2.1.el8_9 |
| Red Hat Enterprise Linux 8 | ruby | 0:2.5.9-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | ruby-debuginfo | 0:2.5.9-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | ruby-debugsource | 0:2.5.9-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | ruby-devel | 0:2.5.9-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | ruby-doc | 0:2.5.9-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | ruby-irb | 0:2.5.9-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | ruby-libs | 0:2.5.9-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | ruby-libs-debuginfo | 0:2.5.9-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-abrt | 0:0.3.0-4.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-abrt-doc | 0:0.3.0-4.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-bigdecimal | 0:1.3.4-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-bigdecimal-debuginfo | 0:1.3.4-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-bson | 0:4.3.0-2.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-bson-debuginfo | 0:4.3.0-2.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-bson-debugsource | 0:4.3.0-2.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-bson-doc | 0:4.3.0-2.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-bundler | 0:1.16.1-5.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-bundler-doc | 0:1.16.1-5.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-did_you_mean | 0:1.2.0-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-io-console | 0:0.4.6-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-io-console-debuginfo | 0:0.4.6-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-json | 0:2.1.0-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-json-debuginfo | 0:2.1.0-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-minitest | 0:5.10.3-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-mongo | 0:2.5.1-2.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-mongo-doc | 0:2.5.1-2.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-mysql2 | 0:0.4.10-4.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-mysql2-debuginfo | 0:0.4.10-4.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-mysql2-debugsource | 0:0.4.10-4.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-mysql2-doc | 0:0.4.10-4.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-net-telnet | 0:0.1.1-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-openssl | 0:2.1.2-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-openssl-debuginfo | 0:2.1.2-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-pg | 0:1.0.0-3.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-pg-debuginfo | 0:1.0.0-3.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-pg-debugsource | 0:1.0.0-3.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-pg-doc | 0:1.0.0-3.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-power_assert | 0:1.1.1-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-psych | 0:3.0.2-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-psych-debuginfo | 0:3.0.2-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-rake | 0:12.3.3-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-rdoc | 0:6.0.1.1-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-test-unit | 0:3.2.7-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygem-xmlrpc | 0:0.3.0-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygems | 0:2.7.6.3-114.module+el8.10.0+23088+750dc6ca |
| Red Hat Enterprise Linux 8 | rubygems-devel | 0:2.7.6.3-114.module+el8.10.0+23088+750dc6ca |
| Red Hat rhel eus 8.6 | oniguruma | 0:6.8.2-2.1.el8_6 |
| Red Hat rhel eus 8.6 | oniguruma-debuginfo | 0:6.8.2-2.1.el8_6 |
| Red Hat rhel eus 8.6 | oniguruma-debugsource | 0:6.8.2-2.1.el8_6 |
| Red Hat rhel eus 8.6 | oniguruma-devel | 0:6.8.2-2.1.el8_6 |
| Red Hat rhel eus 8.8 | oniguruma | 0:6.8.2-2.1.el8_8 |
| Red Hat rhel eus 8.8 | oniguruma-debuginfo | 0:6.8.2-2.1.el8_8 |
| Red Hat rhel eus 8.8 | oniguruma-debugsource | 0:6.8.2-2.1.el8_8 |
| Red Hat rhel eus 8.8 | oniguruma-devel | 0:6.8.2-2.1.el8_8 |
| Rocky Linux 8 | ruby | 0:2.5.9-114.module+el8.10.0+1979+815637df |
| Rocky Linux 8 | rubygem-abrt | 0:0.3.0-4.module+el8.9.0+1536+5f79634e |
| Rocky Linux 8 | rubygem-abrt | 0:0.3.0-4.module+el8.5.0+738+032c9c02 |
| Rocky Linux 8 | rubygem-bson | 0:4.3.0-2.module+el8.9.0+1536+5f79634e |
| Rocky Linux 8 | rubygem-bundler | 0:1.16.1-5.module+el8.10.0+1979+815637df |
| Rocky Linux 8 | rubygem-mongo | 0:2.5.1-2.module+el8.9.0+1536+5f79634e |
| Rocky Linux 8 | rubygem-mysql2 | 0:0.4.10-4.module+el8.9.0+1536+5f79634e |
| Rocky Linux 8 | rubygem-pg | 0:1.0.0-3.module+el8.9.0+1536+5f79634e |
| Ubuntu Pro 14.04 LTS | libonig | 5.9.1-1ubuntu1.1+esm2 |
| Ubuntu Pro 14.04 LTS | libonig | 5.9.1-1ubuntu1.1+esm3 |
| Ubuntu Pro 16.04 LTS | libonig | 5.9.6-1ubuntu0.1+esm2 |
| Ubuntu Pro 16.04 LTS | libonig | 5.9.6-1ubuntu0.1+esm3 |
| Ubuntu Pro 18.04 LTS | libonig | 6.7.0-1ubuntu0.1~esm2 |
| openSUSE Tumbleweed | oniguruma | 6.9.7.1-1.2 |