PatchTheCVEoniguruma project vulnerabilities
Recent CVEs affecting oniguruma project products. 6 tracked.
oniguruma project has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2019-11-25. Highest priority: CVE-2019-19012 (score 73/100).
- CVE-2019-19246 HIGH 7.5 UPGRADE UPGRADE Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_low
- CVE-2019-19204 HIGH 7.5 UPGRADE MITIGATE An issue was discovered in Oniguruma 6.x before 6.9.4_rc2
- CVE-2019-19203 HIGH 7.5 UPGRADE MITIGATE An issue was discovered in Oniguruma 6.x before 6.9.4_rc2
- CVE-2019-19012 CRITICAL 9.8 UPGRADE MITIGATE An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an
- CVE-2019-13225 MEDIUM 6.5 DOWNGRADE MITIGATE A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause
- CVE-2019-13224 CRITICAL 9.8 DOWNGRADE UPGRADE A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause inf
FAQ
How do I fix oniguruma project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is oniguruma project being exploited right now?
None of the tracked oniguruma project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which oniguruma project CVE should I patch first?
CVE-2019-19012 currently ranks highest (73/100): An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an.