Vendors / Oniguruma Project Records 13 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 7
CVSS high 5
Exploited now Oniguruma Project records in CISA KEV No Oniguruma Project vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 55
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10628 · Published 2019-11-16 · Partial fix CWE-125
Priority MEDIUM 52
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07511 · Published 2017-05-24 · Partial fix CWE-787
Priority MEDIUM 51
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06261 · Published 2017-05-24 · Partial fix CWE-787
Priority MEDIUM 51
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06265 · Published 2017-05-24 · Partial fix CWE-125
Priority MEDIUM 51
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0654 · Published 2017-05-24 · Partial fix CWE-125
Priority MEDIUM 49
A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04047 · Published 2019-07-10 · Partial fix CWE-416
Priority MEDIUM 48
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0308 · Published 2017-05-24 · Partial fix CWE-787
Priority MEDIUM 43
An issue was discovered in Oniguruma 6.x before 6.9.4_rc2.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.06889 · Published 2019-11-21 · Partial fix CWE-125
Priority MEDIUM 41
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.05129 · Published 2017-05-24 · Partial fix CWE-476
Priority MEDIUM 40
An issue was discovered in Oniguruma 6.x before 6.9.4_rc2.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.04052 · Published 2019-11-21 · Partial fix CWE-125
Priority LOW 38
Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.02966 · Published 2019-11-25 · Partial fix CWE-125
Priority LOW 38
Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.02752 · Published 2019-09-09 · Partial fix CWE-674
Priority LOW 33
A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression.
CVSS 3.1 MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02129 · Published 2019-07-10 · Fixed CWE-476
Open these records in search → All records by CVSS severity
7 5 1 0 0
THREATIST.IORead the docs