PT-2020-16316 · Oniguruma+1 · Oniguruma+1

Published 2020-09-30 · Updated 2024-08-21 · CVE-2020-26159

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Oniguruma version 6.9.5 rev1

Description An issue exists where an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one byte in concat opt exact str in src/regcomp.c.

Recommendations For Oniguruma version 6.9.5 rev1, consider updating to a newer version that addresses this issue, as the current version may allow an attacker to overflow a buffer by one byte. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-26159

DLA-2431-1

DLA-2431-2

MGASA-2020-0452

OPENSUSE-SU-2022_3327-1

OPENSUSE-SU-2024:11111-1

SUSE-SU-2022:3327-1

SUSE-SU-2024:2993-1

SUSE-SU-2024_2993-1

Affected Products

Oniguruma

Suse

References · 32

• https://nvd.nist.gov/vuln/detail/CVE-2020-26159 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2020-26159 · Vendor Advisory
• https://debian.org/lts/security/2020/dla-2431 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0452.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:2993-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3327-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11111-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2431-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2431-2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26159 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/ZFUJY7BUIFBTZ3IUHVHCID4JYCRDGKPS · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0452 · Vendor Advisory
• https://bugzilla.suse.com/1164550 · Note
• https://suse.com/security/cve/CVE-2019-19204 · Note
• https://suse.com/support/update/announcement/2024/suse-su-20242993-1 · Note