PatchTheCVEoniguruma vulnerabilities and fixes
Recent CVEs affecting oniguruma, with upgrade or downgrade steps. 12 tracked.
oniguruma has 12 tracked vulnerabilities, 7 critical. A fixed release or vendor patch exists for 11. Most recent: 2019-11-25. Highest priority: CVE-2019-19012 (score 73/100).
- CVE-2019-19246 HIGH 7.5 UPGRADE UPGRADE Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_low
- CVE-2019-19204 HIGH 7.5 UPGRADE MITIGATE An issue was discovered in Oniguruma 6.x before 6.9.4_rc2
- CVE-2019-19203 HIGH 7.5 UPGRADE MITIGATE An issue was discovered in Oniguruma 6.x before 6.9.4_rc2
- CVE-2019-19012 CRITICAL 9.8 UPGRADE MITIGATE An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an
- CVE-2019-13225 MEDIUM 6.5 DOWNGRADE MITIGATE A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause
- CVE-2019-13224 CRITICAL 9.8 DOWNGRADE UPGRADE A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause inf
- CVE-2017-9229 HIGH 7.5 DOWNGRADE UPGRADE An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
- CVE-2017-9228 CRITICAL 9.8 DOWNGRADE UPGRADE An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
- CVE-2017-9227 CRITICAL 9.8 DOWNGRADE UPGRADE An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
- CVE-2017-9226 CRITICAL 9.8 DOWNGRADE UPGRADE An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
- CVE-2017-9225 CRITICAL 9.8 DOWNGRADE UPGRADE An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
- CVE-2017-9224 CRITICAL 9.8 DOWNGRADE UPGRADE An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP
FAQ
How do I fix oniguruma vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is oniguruma being exploited right now?
None of the tracked oniguruma CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which oniguruma CVE should I patch first?
CVE-2019-19012 currently ranks highest (73/100): An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an.