PT-2019-5887 · Oniguruma+8 · Oniguruma+8
Manhnd
·
Published
2019-11-06
·
Updated
2025-09-29
·
CVE-2019-19204
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Oniguruma versions prior to 6.9.4 rc2
Description
The issue is related to the function
fetch interval quantifier (formerly known as fetch range quantifier) in the Oniguruma library for regular expressions, which is associated with a heap-based buffer over-read. This can be exploited by a remote attacker to cause a denial of service.Recommendations
For Oniguruma versions prior to 6.9.4 rc2, update to version 6.9.4 rc2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
fetch interval quantifier function until a patch is available.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Oniguruma
Red Hat
Rocky Linux
Suse
Ubuntu