CVE-2019-13224

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.3.20). (BZ#1856655)

Security Fix(es):

• php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

• php: Buffer over-read in exif_read_data() (CVE-2019-11040)

• php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte (CVE-2019-11045)

• php: Information disclosure in exif_read_data() (CVE-2019-11047)

• php: Integer wraparounds when receiving multipart forms (CVE-2019-11048)

• oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

• oniguruma: NULL pointer dereference in match_at() in regexec.c (CVE-2019-13225)

• oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

• oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c (CVE-2019-19203)

• oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c (CVE-2019-19204)

• pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode (CVE-2019-20454)

• php: Out of bounds read in php_strip_tags_ex (CVE-2020-7059)

• php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function (CVE-2020-7060)

• php: NULL pointer dereference in PHP session upload progress (CVE-2020-7062)

• php: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)

• php: Information disclosure in exif_read_data() function (CVE-2020-7064)

• php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution (CVE-2020-7065)

• php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

• php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

• php: Out of bounds read when parsing EXIF information (CVE-2019-11050)

• oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c (CVE-2019-19246)

• php: Information disclosure in function get_headers (CVE-2020-7066)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.3.20). (BZ#1856655)

Security Fix(es):

• php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

• php: Buffer over-read in exif_read_data() (CVE-2019-11040)

• php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte (CVE-2019-11045)

• php: Information disclosure in exif_read_data() (CVE-2019-11047)

• php: Integer wraparounds when receiving multipart forms (CVE-2019-11048)

• oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

• oniguruma: NULL pointer dereference in match_at() in regexec.c (CVE-2019-13225)

• oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

• oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c (CVE-2019-19203)

• oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c (CVE-2019-19204)

• pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode (CVE-2019-20454)

• php: Out of bounds read in php_strip_tags_ex (CVE-2020-7059)

• php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function (CVE-2020-7060)

• php: NULL pointer dereference in PHP session upload progress (CVE-2020-7062)

• php: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)

• php: Information disclosure in exif_read_data() function (CVE-2020-7064)

• php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution (CVE-2020-7065)

• php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

• php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

• php: Out of bounds read when parsing EXIF information (CVE-2019-11050)

• oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c (CVE-2019-19246)

• php: Information disclosure in function get_headers (CVE-2020-7066)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Oniguruma is a regular expressions library that supports a variety of character encodings.

Security Fix(es):

• oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)
• oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)
• oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read (CVE-2019-19012)
• oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c (CVE-2019-19203)
• oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c (CVE-2019-19204)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
• Fix bug #70728: Type Confusion Vulnerability in PHP_to_XMLRPC_worker()
• Fix bug #70661: Use After Free Vulnerability in WDDX Packet Deserialization
• Fix bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
• Fix bug #71459: Integer overflow in iptcembed()
• Fix bug #71039: exec functions ignore length but look for NULL termination
• Fix bug #71354: Heap corruption in tar/zip/phar parser.
• Fix bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()
• Fix bug #71323: Output of stream_get_meta_data can be falsified by its input
• Fix bug #71498: Out-of-Bound Read in phar_parse_zipfile()
• Fix bug #71587: Use-After-Free / Double-Free in WDDX Deserialize
• Fix bug #71860: Invalid memory write in phar on filename with \0 in name
• Fix bug #71798: Integer Overflow in php_raw_url_encode
• Fix bug #72837: integer overflow in bzdecompress caused heap corruption
• Fix bug #72681: PHP Session Data Injection Vulnerability
• Fix bug #72807: integer overflow in curl_escape caused heap corruption
• Fix bug #72838: Integer overflow lead to heap corruption in sql_regcase
• Fix bug #72697: select_colors write out-of-bounds
• Fix bug #72730: imagegammacorrect allows arbitrary write access
• Fix bug #72836: integer overflow in base64_decode caused heap corruption
• Fix bug #72848: integer overflow in quoted_printable_encode caused heap corruption
• Fix bug #72849: integer overflow in urlencode caused heap corruption
• Fix bug #72850: integer overflow in php_uuencode caused heap corruption
• Fix bug #72771: ftps:// wrapper is vulnerable to protocol downgrade attack
• Fix bug #72749: wddx_deserialize allows illegal memory access
• Fix bug #72750: wddx_deserialize null dereference
• Fix bug #72790: wddx_deserialize null dereference with invalid xml
• Fix bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
• Fix bug #73189: Memcpy negative size parameter php_resolve_path
• Fix bug #73150: missing NULL check in dom_document_save_html
• Fix bug #73284: heap overflow in php_ereg_replace function
• Fix bug #73218: stack-buffer-overflow through "ResourceBundle" methods
• Fix bug #73208: integer overflow in imap_8bit caused heap corruption
• Fix bug #73082: string length overflow in mb_encode_* function
• Fix bug #73174: heap overflow in php_pcre_replace_impl
• Fix bug #73276: crash in openssl_random_pseudo_bytes function
• Fix bug #73275: crash in openssl_encrypt function
• Fix bug #73017: memory corruption in wordwrap function
• Fix bug #73240: Write out of bounds at number_format
• Fix bug #73073: CachingIterator null dereference when convert to string
• Fix bug #73293: NULL pointer dereference in SimpleXMLElement::asXML()
• Fix bug #73356: crash in bzcompress function
• Fix bug #72696: imagefilltoborder stackoverflow on truecolor images
• Fix bug #73418: Integer Overflow in "_php_imap_mail" leads Heap Overflow
• Fix bug #73144: Use-after-free in ArrayObject Deserialization
• Fix bug #73192: parse_url return wrong hostname
• Fix bug #73331: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow
• Fix bug #73452: Segfault (Regression for #69152)
• Fix bug #73631: Invalid read when wddx decodes empty boolean element
• Fix bug #67587: Redirection loop on nginx with FPM
• Fix bug #71465: PHAR doesn't know about litespeed
• Fix bug #73737: FPE when parsing a tag format
• Fix bug #73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
• Fix bug #73869: Signed Integer Overflow gd_io.c
• Fix bug #73773: Seg fault when loading hostile phar
• Fix bug #70436: Use After Free Vulnerability in unserialize()
• Fix bug #74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
• Fix bug #72535: arcfour encryption stream filter crashes php
• Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unseria
• Fix bug #72455: Heap Overflow due to integer overflows
• Fix bug #74782:…

• SECURITY UPDATE: use-after-free in oniguruma onig_new_deluxe()
  • debian/patches/CVE-2019-13224.patch: reject mismatched encodings in ext/mbstring/oniguruma/regext.c so onig_new_deluxe() returns ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION instead of calling the buggy conv_encoding() path.
  • CVE-2019-13224
• SECURITY UPDATE: heap buffer over-read in oniguruma str_lower_case_match
  • debian/patches/CVE-2019-19246.patch: add bounds check (t >= tend) inside the lowlen loop of str_lower_case_match in ext/mbstring/oniguruma/regexec.c before dereferencing t.
  • CVE-2019-19246

• CVE-2019-9020: fix heap out-of-bounds read in xmlrpc_decode()
• CVE-2019-9021: fix heap buffer overflow in phar_detect_phar_fname_ext
• CVE-2019-9023: fix heap buffer over-reads in mbstring regex functions
• CVE-2019-9641: fix uninitialized read in exif_process_IFD_in_TIFF
• CVE-2019-11034: fix heap-buffer-overflow in exif_process_IFD_in_MAKERNOTE
• CVE-2019-11035: fix heap-buffer-overflow in exif_iif_add_value
• CVE-2019-11036: fix heap-buffer-overflow in exif_process_IFD_TAG
• CVE-2019-11040: fix heap-buffer-overflow on php_jpg_get16
• CVE-2019-13224: do not allow different encodings for onig_new_deluxe()

Updated php packages fix security vulnerabilities:

A use-after-free in onig_new_deluxe() in regext.c in the bundled Oniguruma allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression (CVE-2019-13224).

A NULL Pointer Dereference in match_at() in regexec.c in the bundled Oniguruma allows attackers to potentially cause denial of service by providing a crafted regular expression (CVE-2019-13225).

For other fixes in this update, see the referenced changelog.

Updated oniguruma packages fix security vulnerabilities:

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe() (CVE-2019-13224).

A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression (CVE-2019-13225).

Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163).

An integer overflow in the search_in_range function in regexec.c leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression (CVE-2019-19012).

An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read (CVE-2019-19203).

In the function fetch_range_quantifier in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read and lead to denial-of-service via a crafted regular expression (CVE-2019-19204).

Heap-based buffer over-read in str_lower_case_match in regexec.c can lead to denial-of-service via a crafted regular expression (CVE-2019-19246).

These are all security issues fixed in the libonig5-6.9.7.1-1.2 package on the GA media of openSUSE Tumbleweed.

This update for oniguruma fixes the following issues:

• CVE-2019-19246: Fixed an out of bounds access during regular expression matching (bsc#1157805).
• CVE-2019-19204: Fixed an out of bounds access when compiling a crafted regular expression (bsc#1164569).
• CVE-2019-19203: Fixed an out of bounds access when performing a string search (bsc#1164550).
• CVE-2019-16163: Fixed an uncontrolled recursion issue when compiling a crafted regular expression, which could lead to denial of service (bsc#1150130).
• CVE-2020-26159: Fixed an off-by-one buffer overflow (bsc#1177179).
• CVE-2019-13224: Fixed a potential use-after-free when handling multiple different encodings (bsc#1142847).

It was discovered that PHP incorrectly handled certain regular expressions. An attacker could possibly use this issue to expose sensitive information, cause a denial of service or execute arbitrary code.