CVE-2019-19204
oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read.
Se detectó un problema en Oniguruma versiones 6.x anteriores a 6.9.4_rc2. En la función fetch_interval_quantifier (anteriormente conocida como fetch_range_quantifier) ??en el archivo regparse.c, PFETCH es llamada sin comprobar PEND. Esto conlleva a una lectura excesiva de búfer en la región heap de la memoria.
An out-of-bounds read vulnerability was found in Oniguruma in the way it handled regular expression quantifiers. A remote attacker could abuse this flaw by providing a malformed regular expression that, when processed by an application linked to Oniguruma, could possibly crash the application, resulting in a denial of service.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-11-21 CVE Reserved
- 2019-11-21 CVE Published
- 2024-03-16 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| https://github.com/kkos/oniguruma/releases/tag/v6.9.4_rc2 | Release Notes | |
| https://lists.debian.org/debian-lts-announce/2019/12/msg00002.html | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/ManhNDd/CVE-2019-19204 | 2024-08-05 | |
| https://github.com/tarantula-team/CVE-2019-19204 | 2024-08-05 | |
| https://github.com/kkos/oniguruma/issues/162 | 2024-08-05 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Oniguruma Project Search vendor "Oniguruma Project" | Oniguruma Search vendor "Oniguruma Project" for product "Oniguruma" | >= 6.0.0 < 6.9.4 Search vendor "Oniguruma Project" for product "Oniguruma" and version " >= 6.0.0 < 6.9.4" | - |
Affected
| ||||||
| Oniguruma Project Search vendor "Oniguruma Project" | Oniguruma Search vendor "Oniguruma Project" for product "Oniguruma" | 6.9.4 Search vendor "Oniguruma Project" for product "Oniguruma" and version "6.9.4" | rc1 |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 30 Search vendor "Fedoraproject" for product "Fedora" and version "30" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 31 Search vendor "Fedoraproject" for product "Fedora" and version "31" | - |
Affected
| ||||||