An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read     (CVE-2019-19012)

  - php: phar Buffer mismanagement (CVE-2023-3824)

  - main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting     fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to     127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this     example) is hardcoded into an application as a security policy, but the hostname argument (i.e.,     127.0.0.1:80 in this example) is obtained from untrusted input. (CVE-2017-7189)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

This plugin was deprecated due to incorrect CVE matches for the build.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0889 advisory.

  - A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause     information disclosure, denial of service, or possibly code execution by providing a crafted regular     expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that     gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional     libraries for PHP and Rust. (CVE-2019-13224)

  - Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.
    (CVE-2019-16163)

  - An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads     to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only     affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information     disclosure, or possibly have unspecified other impact, via a crafted regular expression. (CVE-2019-19012)

  - An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file     gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string.
    This leads to a heap-based buffer over-read. (CVE-2019-19203)

  - An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier     (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This     leads to a heap-based buffer over-read. (CVE-2019-19204)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0889 advisory.

    - Fix CVE-2019-13224       Resolves: RHEL-6970
    - Fix CVE-2019-16163       Resolves: RHEL-9506
    - Fix CVE-2019-19012       Resolves: RHEL-9511
    - Fix CVE-2019-19203       Resolves: RHEL-9510

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0889 advisory.

    Oniguruma is a regular expressions library that supports a variety of character encodings.

    Security Fix(es):

    * oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

    * oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

    * oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read     (CVE-2019-19012)

    * oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c     (CVE-2019-19203)

    * oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c     (CVE-2019-19204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0572 advisory.

    Oniguruma is a regular expressions library that supports a variety of character encodings.

    Security Fix(es):

    * oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

    * oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

    * oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read     (CVE-2019-19012)

    * oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c     (CVE-2019-19203)

    * oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c     (CVE-2019-19204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0409 advisory.

    Oniguruma is a regular expressions library that supports a variety of character encodings.

    Security Fix(es):

    * oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

    * oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

    * oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read     (CVE-2019-19012)

    * oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c     (CVE-2019-19203)

    * oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c     (CVE-2019-19204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5662-1 advisory.

    It was discovered that Oniguruma incorrectly handled certain regular expressions. An attacker could     possibly use this issue to cause a denial of service, obtain sensitive information or other unspecified     impact. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2019-16163, CVE-2019-19012,     CVE-2019-19204, CVE-2019-19246)

    It was discovered that Oniguruma incorrectly handled memory when using certain UChar pointers. An attacker     could possibly use this issue to cause a denial of service or sensitive information disclosure.
    (CVE-2019-19203)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the oniguruma package has been released.

Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. (CVE-2019-16163)

Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.(CVE-2019-19246)

Address CVE-2019-19204 CVE-2019-19203 CVE-2019-19012. Fixes are backported.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in the Oniguruma regular expressions library, notably used in PHP mbstring.

CVE-2019-19012

An integer overflow in the search_in_range function in regexec.c leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial of service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.

CVE-2019-19204

In the function fetch_range_quantifier in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read and lead to denial of service via a crafted regular expression.

CVE-2019-19246

Heap-based buffer over-read in str_lower_case_match in regexec.c can lead to denial of service via a crafted regular expression.

For Debian 8 'Jessie', these problems have been fixed in version 5.9.5-3.2+deb8u4.

We recommend that you upgrade your libonig packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

6.9.4 final is released. This new version addresses CVE-2019-19246 (this one is already fixed in previous rpm), CVE-2019-19204 CVE-2019-19203 CVE-2019-19012.

----

Update to 6.9.4 rc3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
202269	RHEL 8 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196720	RHEL 5 : oniguruma (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196639	RHEL 6 : oniguruma (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
191425	CentOS 9 : oniguruma-6.9.6-1.el9.5 (deprecated)	Nessus	CentOS Local Security Checks	critical
190903	AlmaLinux 8 : oniguruma (ALSA-2024:0889)	Nessus	Alma Linux Local Security Checks	critical
190822	Oracle Linux 8 : oniguruma (ELSA-2024-0889)	Nessus	Oracle Linux Local Security Checks	critical
190768	RHEL 8 : oniguruma (RHSA-2024:0889)	Nessus	Red Hat Local Security Checks	critical
189806	RHEL 8 : oniguruma (RHSA-2024:0572)	Nessus	Red Hat Local Security Checks	critical
189542	RHEL 8 : oniguruma (RHSA-2024:0409)	Nessus	Red Hat Local Security Checks	critical
183144	Ubuntu 16.04 ESM / 18.04 ESM : Oniguruma vulnerabilities (USN-5662-1)	Nessus	Ubuntu Local Security Checks	critical
133067	Photon OS 3.0: Oniguruma PHSA-2020-3.0-0047	Nessus	PhotonOS Local Security Checks	critical
132975	Photon OS 2.0: Oniguruma PHSA-2019-2.0-0196	Nessus	PhotonOS Local Security Checks	critical
132735	Amazon Linux 2 : oniguruma (ALAS-2020-1380)	Nessus	Amazon Linux Local Security Checks	critical
131792	Fedora 30 : oniguruma (2019-73197ff9a0)	Nessus	Fedora Local Security Checks	critical
131705	Debian DLA-2020-1 : libonig security update	Nessus	Debian Local Security Checks	critical
131575	Fedora 31 : oniguruma (2019-d942abd0d4)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2019-19012

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical