| Package | Affected versions | Patched versions |
|---|---|---|
| oniguruma | = 6.9.2 | |
| php | ≥ 7.1.0, < 7.1.32≥ 7.2.0, < 7.2.23≥ 7.3.0, < 7.3.9 | 7.1.327.2.237.3.9 |
A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free