Red Hat Security AdvisoryRHSA-2024:0409
oniguruma security update
Released 2024-01-25 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder EUS (v.8.6) oniguruma-devel-6.8.2-2.1.el8_6
- Red Hat Enterprise Linux AppStream EUS (v.8.6) oniguruma-6.8.2-2.1.el8_6
Fixes 5 records
Priority MEDIUM 55
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10628 · Published 2019-11-16 · Partial fix CWE-125
Priority MEDIUM 49
A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04047 · Published 2019-07-10 · Partial fix CWE-416
Priority MEDIUM 43
An issue was discovered in Oniguruma 6.x before 6.9.4_rc2.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06889 · Published 2019-11-21 · Partial fix CWE-125
Priority MEDIUM 40
An issue was discovered in Oniguruma 6.x before 6.9.4_rc2.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04052 · Published 2019-11-21 · Partial fix CWE-125
Priority LOW 38
Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02752 · Published 2019-09-09 · Partial fix CWE-674
THREATIST.IORead the docs