CVE-2019-13224

 

Published at: - 10-07-2019 04:15

Last modified: - 20-07-2022 06:33

Total changes: - 2

Description

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55
• [debian-lts-announce] 20190717 [SECURITY] [DLA 1854-1] libonig security update-Mailing List, Third Party Advisory
• FEDORA-2019-3f3d0953db-Mailing List, Third Party Advisory
• FEDORA-2019-5409bb5e68-Mailing List, Third Party Advisory
• USN-4088-1-Third Party Advisory
• https://support.f5.com/csp/article/K00103182
• https://support.f5.com/csp/article/K00103182?utm_source=f5support&utm_medium=RSS
• GLSA-201911-03-Third Party Advisory

 

Keywords

NVD

 

CVE-2019-13224

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures