CVE-2019-19246

Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.3.20). (BZ#1856655)

Security Fix(es):

• php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

• php: Buffer over-read in exif_read_data() (CVE-2019-11040)

• php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte (CVE-2019-11045)

• php: Information disclosure in exif_read_data() (CVE-2019-11047)

• php: Integer wraparounds when receiving multipart forms (CVE-2019-11048)

• oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

• oniguruma: NULL pointer dereference in match_at() in regexec.c (CVE-2019-13225)

• oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

• oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c (CVE-2019-19203)

• oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c (CVE-2019-19204)

• pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode (CVE-2019-20454)

• php: Out of bounds read in php_strip_tags_ex (CVE-2020-7059)

• php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function (CVE-2020-7060)

• php: NULL pointer dereference in PHP session upload progress (CVE-2020-7062)

• php: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)

• php: Information disclosure in exif_read_data() function (CVE-2020-7064)

• php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution (CVE-2020-7065)

• php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

• php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

• php: Out of bounds read when parsing EXIF information (CVE-2019-11050)

• oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c (CVE-2019-19246)

• php: Information disclosure in function get_headers (CVE-2020-7066)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.3.20). (BZ#1856655)

Security Fix(es):

• php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

• php: Buffer over-read in exif_read_data() (CVE-2019-11040)

• php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte (CVE-2019-11045)

• php: Information disclosure in exif_read_data() (CVE-2019-11047)

• php: Integer wraparounds when receiving multipart forms (CVE-2019-11048)

• oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

• oniguruma: NULL pointer dereference in match_at() in regexec.c (CVE-2019-13225)

• oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

• oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c (CVE-2019-19203)

• oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c (CVE-2019-19204)

• pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode (CVE-2019-20454)

• php: Out of bounds read in php_strip_tags_ex (CVE-2020-7059)

• php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function (CVE-2020-7060)

• php: NULL pointer dereference in PHP session upload progress (CVE-2020-7062)

• php: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)

• php: Information disclosure in exif_read_data() function (CVE-2020-7064)

• php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution (CVE-2020-7065)

• php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

• php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

• php: Out of bounds read when parsing EXIF information (CVE-2019-11050)

• oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c (CVE-2019-19246)

• php: Information disclosure in function get_headers (CVE-2020-7066)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: use-after-free in oniguruma onig_new_deluxe()
  • debian/patches/CVE-2019-13224.patch: reject mismatched encodings in ext/mbstring/oniguruma/regext.c so onig_new_deluxe() returns ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION instead of calling the buggy conv_encoding() path.
  • CVE-2019-13224
• SECURITY UPDATE: heap buffer over-read in oniguruma str_lower_case_match
  • debian/patches/CVE-2019-19246.patch: add bounds check (t >= tend) inside the lowlen loop of str_lower_case_match in ext/mbstring/oniguruma/regexec.c before dereferencing t.
  • CVE-2019-19246

• CVE-2018-14883: fix integer overflow leading to heap buffer overflow in exif_thumbnail_extract
• CVE-2019-19246: fix heap buffer overflow in oniguruma str_lower_case_match
• CVE-2018-19518: disable imap rsh/ssh by default to prevent argument injection (imap.enable_insecure_rsh INI added)
• CVE-2018-20783: add buffer bounds checks to phar_parse_pharfile manifest reads

• CVE-2018-14883: fix int overflow leading to heap overflow in exif_thumbnail_extract
• CVE-2019-6977: fix imagecolormatch out-of-bounds write on heap in GD
• CVE-2019-9022: fix memcpy with negative length via crafted DNS response
• CVE-2019-9640: fix invalid read in exif_process_SOFn
• CVE-2019-11042: fix heap buffer overflow in exif_process_user_comment
• CVE-2019-9638, CVE-2019-9639: fix uninitialized read in exif_process_IFD_in_MAKERNOTE (single upstream commit covers both)
• CVE-2019-9637: safer rename() procedure to avoid permission leak on EXDEV cross-filesystem fallback
• CVE-2019-19246: fix Oniguruma out-of-bounds read in str_lower_case_match
• CVE-2019-9024: fix xmlrpc base64 out-of-bounds read via unsigned char cast
• CVE-2018-20783: fix phar_parse_pharfile buffer over-read via stricter manifest bounds checks
• CVE-2018-19518: disable rsh/ssh logins in imap_open by default (new no_rsh/no_ssh INI entries)
• CVE-2018-19935: fix imap_mail NULL pointer dereference on empty message parameter

Updated oniguruma packages fix security vulnerabilities:

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe() (CVE-2019-13224).

A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression (CVE-2019-13225).

Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163).

An integer overflow in the search_in_range function in regexec.c leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression (CVE-2019-19012).

An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read (CVE-2019-19203).

In the function fetch_range_quantifier in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read and lead to denial-of-service via a crafted regular expression (CVE-2019-19204).

Heap-based buffer over-read in str_lower_case_match in regexec.c can lead to denial-of-service via a crafted regular expression (CVE-2019-19246).

These are all security issues fixed in the libonig5-6.9.7.1-1.2 package on the GA media of openSUSE Tumbleweed.

This update for oniguruma fixes the following issues:

• CVE-2019-19246: Fixed an out of bounds access during regular expression matching (bsc#1157805).
• CVE-2019-19204: Fixed an out of bounds access when compiling a crafted regular expression (bsc#1164569).
• CVE-2019-19203: Fixed an out of bounds access when performing a string search (bsc#1164550).
• CVE-2019-16163: Fixed an uncontrolled recursion issue when compiling a crafted regular expression, which could lead to denial of service (bsc#1150130).
• CVE-2020-26159: Fixed an off-by-one buffer overflow (bsc#1177179).
• CVE-2019-13224: Fixed a potential use-after-free when handling multiple different encodings (bsc#1142847).

It was discovered that Oniguruma incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information or other unspecified impact. (CVE-2019-16163, CVE-2019-19012, CVE-2019-19204, CVE-2019-19246)

It was discovered that Oniguruma incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information or other unspecified impact. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2019-16163, CVE-2019-19012, CVE-2019-19204, CVE-2019-19246)

It was discovered that Oniguruma incorrectly handled memory when using certain UChar pointers. An attacker could possibly use this issue to cause a denial of service or sensitive information disclosure. (CVE-2019-19203)