CVE-2019-19012
Critical
Description
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Oniguruma
PublishedNov 17, 2019
First seenNov 17, 2019
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oniguruma_project oniguruma | 6.0.0 ≤ v ≤ 6.9.3, 6.9.4 | — |
| debian debian_linux | 8.0 | — |
| fedoraproject fedora | 30, 31 | — |
| redhat enterprise_linux | 8.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.