CVE-2019-13224 Information
Share on:Description
A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure denial of service or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby as well as common optional libraries for PHP and Rust.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reference
https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55 https://lists.debian.org/debian-lts-announce/2019/07/msg00013.html https://lists.fedoraproject.org/archives/list/[email protected]/message/JWCPDTZOIUKGMFAD5NAKUB7FPJFAIQN5/ https://lists.fedoraproject.org/archives/list/[email protected]/message/SNL26OZSQRVLEO6JRNUVIMZTICXBNEQW/ https://security.gentoo.org/glsa/201911-03 https://support.f5.com/csp/article/K00103182 https://support.f5.com/csp/article/K00103182?utm_source=f5support&utm_medium=RSS https://usn.ubuntu.com/4088-1/
Attack Complexity
LOW
Privileges Required
NONE
User Interaction Required
NONE
Scope
NONE
Confidentiality Impact
UNCHANGED
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
HIGH
Base Severity
9.8