{"id":"CVE-2019-19012","aliases":["ALSA-2024:0889","ALSA-2025:7539","BELL-CVE-2019-19012","DEBIAN-CVE-2019-19012","DLA-2020-1","DLA-2431-1","EUVD-2019-8663","GHSA-5mw9-mr3r-536c","MGASA-2020-0029","RHSA-2024:0409","RHSA-2024:0572","RHSA-2024:0889","RHSA-2025:7539","RLSA-2025:7539","UBUNTU-CVE-2019-19012","USN-4460-1","USN-5662-1","openSUSE-SU-2024:11111-1"],"status":"published","title":"An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9...","description":"An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.10628,"percentile":0.95828,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-125","CWE-190"],"published":"2019-11-16T15:30:47Z","modified":"2026-10-29T11:02:27Z","exploits":[{"source":"pocgithub","id":"ManhNDd/CVE-2019-19012","title":"ManhNDd/CVE-2019-19012","date":"2019-11-20","url":"https://github.com/ManhNDd/CVE-2019-19012"},{"source":"pocgithub","id":"tarantula-team/CVE-2019-19012","title":"tarantula-team/CVE-2019-19012","date":"2019-11-20","url":"https://github.com/tarantula-team/CVE-2019-19012"}],"fixes":[{"ecosystem":"Debian:12","package":"libonig","fixed_in":["6.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libonig","fixed_in":["6.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libonig","fixed_in":["6.9.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libonig","fixed_in":["5.9.1-1ubuntu1.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libonig","fixed_in":["5.9.6-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libonig","fixed_in":["6.7.0-1ubuntu0.1~esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.2-2.1.el8_9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oniguruma-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.2-2.1.el8_9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-4.module_el8.5.0+2625+ec418553"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-abrt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-4.module_el8.10.0+3871+342e2c2f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2.module_el8.5.0+2625+ec418553"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2.module_el8.6.0+3170+4b08f9d4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2.module_el8.5.0+259+8cec6917"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bson-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2.module_el8.5.0+2625+ec418553"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-5.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bundler-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-5.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-did_you_mean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.3-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-2.module_el8.5.0+2625+ec418553"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mongo-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-2.module_el8.5.0+2625+ec418553"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.10-4.module_el8.5.0+259+8cec6917"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.10-4.module_el8.5.0+2625+ec418553"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.10-4.module_el8.6.0+3170+4b08f9d4"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.10-4.module_el8.5.0+2625+ec418553"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-net-telnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-3.module_el8.9.0+3635+c6f99506"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-3.module_el8.9.0+3635+c6f99506"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.3-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.1.1-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6.3-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6.3-114.module_el8.10.0+3991+5e651d4e"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libonig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libonig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libonig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libonig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.5-3.2+deb8u4"}]}],"versions":["5.9.5-3.2","5.9.5-3.2+deb8u1","5.9.5-3.2+deb8u2","5.9.5-3.2+deb8u3"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"libonig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.3-2+deb9u1"}]}],"versions":["6.1.3-2"],"bundled":6},{"source":"osv","ecosystem":"Mageia:7","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-1.mga7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"oniguruma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"oniguruma-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"oniguruma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"oniguruma-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"oniguruma-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"oniguruma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"oniguruma-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"oniguruma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"oniguruma-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"oniguruma-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oniguruma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oniguruma-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"oniguruma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"oniguruma-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"oniguruma-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.8.2-2.1.el8_9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.10.0+22021+135c76a8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-abrt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.10.0+22021+135c76a8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.4-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bigdecimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.4-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bson-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bundler-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-did_you_mean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.6-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-io-console-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.6-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-json-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.3-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-2.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mongo-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-2.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-4.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-4.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-4.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-4.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-net-telnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.1-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.2-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.2-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-3.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-3.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-3.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-3.module+el8.9.0+19193+435404ae"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.1-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.2-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-psych-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.2-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.3-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1.1-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.7-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6.3-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6.3-114.module+el8.10.0+23088+750dc6ca"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-114.module+el8.10.0+1979+815637df"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.5.0+738+032c9c02"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.9.0+1536+5f79634e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.module+el8.9.0+1536+5f79634e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-5.module+el8.10.0+1979+815637df"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-mongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-2.module+el8.9.0+1536+5f79634e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-4.module+el8.9.0+1536+5f79634e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-3.module+el8.9.0+1536+5f79634e"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libonig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-1ubuntu1.1+esm2"}]}],"versions":["5.9.1-1","5.9.1-1ubuntu1","5.9.1-1ubuntu1.1","5.9.1-1ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libonig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.6-1ubuntu0.1+esm2"}]}],"versions":["5.9.6-1","5.9.6-1ubuntu0.1","5.9.6-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libonig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-1ubuntu0.1~esm2"}]}],"versions":["6.5.0-1","6.6.1-1","6.7.0-1","6.7.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libonig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-1ubuntu1.1+esm2"}]}],"versions":["5.9.1-1","5.9.1-1ubuntu1","5.9.1-1ubuntu1.1","5.9.1-1ubuntu1.1+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libonig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-1ubuntu1.1+esm3"}]}],"versions":["5.9.1-1","5.9.1-1ubuntu1","5.9.1-1ubuntu1.1","5.9.1-1ubuntu1.1+esm1","5.9.1-1ubuntu1.1+esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libonig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.6-1ubuntu0.1+esm3"}]}],"versions":["5.9.6-1","5.9.6-1ubuntu0.1","5.9.6-1ubuntu0.1+esm1","5.9.6-1ubuntu0.1+esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libonig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-1ubuntu0.1~esm2"}]}],"versions":["6.5.0-1","6.6.1-1","6.7.0-1","6.7.0-1ubuntu0.1~esm1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"oniguruma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.7.1-1.2"}]}],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oniguruma_project","product":"oniguruma"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://github.com/kkos/oniguruma/issues/164","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/kkos/oniguruma/releases/tag/v6.9.4_rc2","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/tarantula-team/CVE-2019-19012","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NO267PLHGYZSWX3XTRPKYBKD4J3YOU5V/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/12/msg00002.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3MBNW6Z4DOXSCNWGBLQ7OA3OGUJ44WL/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4460-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19012","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NO267PLHGYZSWX3XTRPKYBKD4J3YOU5V/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3MBNW6Z4DOXSCNWGBLQ7OA3OGUJ44WL/"},{"url":"https://github.com/advisories/GHSA-5mw9-mr3r-536c"},{"url":"https://access.redhat.com/errata/RHSA-2024:0889","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-13224","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16163","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-19012","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-19203","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-19204","tags":["report"]},{"url":"https://bugzilla.redhat.com/1728970","tags":["report"]},{"url":"https://bugzilla.redhat.com/1768997","tags":["report"]},{"url":"https://bugzilla.redhat.com/1802051","tags":["report"]},{"url":"https://bugzilla.redhat.com/1802061","tags":["report"]},{"url":"https://bugzilla.redhat.com/1802068","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-0889.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7539","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-43809","tags":["report"]},{"url":"https://bugzilla.redhat.com/2035260","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-7539.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-19012","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19012","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0029.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25843","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SNL26OZSQRVLEO6JRNUVIMZTICXBNEQW/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NWOWZZNFSAWM3BUTQNAE3PD44A6JU4KE/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2019/dla-2020","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19203","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NO267PLHGYZSWX3XTRPKYBKD4J3YOU5V/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0409","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1728970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1802051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1802061","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1802068","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0409.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13224","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16163","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16163","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19012","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19203","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19203","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19204","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19204","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0572","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0572.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0889.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035260","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7539.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43809","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7539","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-19012","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4460-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5662-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-16163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19203","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26159","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-19012","description":"An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.","status":"published","published":"2019-11-16T15:30:47Z","modified":"2024-08-05T02:02:39.918Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-8663","description":"An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.","status":"published","published":"2019-11-16T15:30:47Z","modified":"2024-08-05T02:02:39Z","updated_at":"2026-11-03T02:40:26.778341Z"}],"ghsa":[{"id":"GHSA-5mw9-mr3r-536c","title":"An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9...","description":"An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.","status":"published","published":"2022-05-24T17:01:25Z","modified":"2023-01-28T05:07:30Z","updated_at":"2026-11-02T14:44:32.070856Z"}],"nvd":[{"id":"CVE-2019-19012","description":"An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.","status":"published","published":"2019-11-17T18:15:11.44Z","modified":"2026-06-17T02:25:58.903Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-125","CWE-190"],"updated_at":"2026-11-02T14:05:37.024431Z"}],"osv":[{"id":"BELL-CVE-2019-19012","title":"CVE-2019-19012 does not affect BellSoft software","status":"withdrawn","published":"2019-11-17T18:15:00Z","modified":"2026-01-26T09:48:47.092446Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-19012","description":"An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.","status":"published","published":"2019-11-17T18:15:11.44Z","modified":"2026-10-20T13:46:42.404742289Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-19012","description":"An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.","status":"published","published":"2019-11-17T18:15:11.44Z","modified":"2026-09-21T07:03:12.545946535Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"RHSA-2024:0409","title":"Red Hat Security Advisory: oniguruma security update","status":"published","published":"2024-09-16T16:51:01Z","modified":"2026-06-28T11:04:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0572","title":"Red Hat Security Advisory: oniguruma security update","status":"published","published":"2024-09-16T16:51:11Z","modified":"2026-06-28T11:05:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0889","title":"Red Hat Security Advisory: oniguruma security update","status":"published","published":"2024-09-16T16:51:20Z","modified":"2026-06-28T11:05:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2025:7539","title":"Red Hat Security Advisory: ruby:2.5 security update","status":"published","published":"2025-05-14T10:06:55Z","modified":"2026-08-07T10:20:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:7539","title":"Moderate: ruby:2.5 security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read (CVE-2019-19012)\n\n* rubygem-bundler: unexpected code execution in Gemfiles (CVE-2021-43809)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T15:00:09.011622Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2019-19012","description":"An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.","status":"published","published":"2019-11-17T18:15:00Z","modified":"2026-04-22T12:14:52.890871Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"ALSA-2024:0889","title":"Moderate: oniguruma security update","description":"Oniguruma is a regular expressions library that supports a variety of character encodings. \n\nSecurity Fix(es):\n\n* oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)\n* oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)\n* oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read (CVE-2019-19012)\n* oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c (CVE-2019-19203)\n* oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c (CVE-2019-19204)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-02-20T00:00:00Z","modified":"2026-10-29T11:02:27.486955069Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2025:7539","title":"Moderate: ruby:2.5 security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read (CVE-2019-19012)\n  * rubygem-bundler: unexpected code execution in Gemfiles (CVE-2021-43809)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-14T00:00:00Z","modified":"2026-10-29T11:02:23.204505525Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"DLA-2020-1","title":"libonig - security update","status":"published","published":"2019-12-04T00:00:00Z","modified":"2026-03-09T01:20:57.248267Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-2431-1","title":"libonig - security update","status":"published","published":"2020-11-03T00:00:00Z","modified":"2026-03-09T01:18:17.635721Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2020-0029","title":"Updated oniguruma packages fix security vulnerabilities","description":"Updated oniguruma packages fix security vulnerabilities:\n\nA use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2\nallows attackers to potentially cause information disclosure, denial\nof service, or possibly code execution by providing a crafted regular\nexpression. The attacker provides a pair of a regex pattern and a string,\nwith a multi-byte encoding that gets handled by onig_new_deluxe()\n(CVE-2019-13224).\n\nA NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2\nallows attackers to potentially cause denial of service by providing a\ncrafted regular expression (CVE-2019-13225).\n\nOniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of\nrecursion in regparse.c (CVE-2019-16163).\n\nAn integer overflow in the search_in_range function in regexec.c leads to\nan out-of-bounds read, in which the offset of this read is under the\ncontrol of an attacker. (This only affects the 32-bit compiled version).\nRemote attackers can cause a denial-of-service or information disclosure,\nor possibly have unspecified other impact, via a crafted regular expression\n(CVE-2019-19012).\n\nAn issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function\ngb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced\nwithout checking if it passed the end of the matched string. This leads to\na heap-based buffer over-read (CVE-2019-19203).\n\nIn the function fetch_range_quantifier in regparse.c, PFETCH is called\nwithout checking PEND. This leads to a heap-based buffer over-read and\nlead to denial-of-service via a crafted regular expression\n(CVE-2019-19204).\n\nHeap-based buffer over-read in str_lower_case_match in regexec.c can lead\nto denial-of-service via a crafted regular expression (CVE-2019-19246).\n","status":"published","published":"2020-01-11T23:52:04Z","modified":"2026-04-16T04:42:49.957996357Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2024:11111-1","title":"libonig5-6.9.7.1-1.2 on GA media","description":"These are all security issues fixed in the libonig5-6.9.7.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:20:06.725105Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-4460-1","title":"libonig vulnerabilities","description":"It was discovered that Oniguruma incorrectly handled certain regular\nexpressions. An attacker could possibly use this issue to cause a denial\nof service, obtain sensitive information or other unspecified impact.\n(CVE-2019-16163, CVE-2019-19012, CVE-2019-19204, CVE-2019-19246)\n","status":"published","published":"2020-08-17T16:46:14Z","modified":"2026-04-22T10:06:23.459977Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-5662-1","title":"libonig vulnerabilities","description":"It was discovered that Oniguruma incorrectly handled certain regular\nexpressions. An attacker could possibly use this issue to cause a denial\nof service, obtain sensitive information or other unspecified impact. This issue\nonly affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2019-16163,\nCVE-2019-19012, CVE-2019-19204, CVE-2019-19246)\n\nIt was discovered that Oniguruma incorrectly handled memory when using certain\nUChar pointers. An attacker could possibly use this issue to cause a denial of\nservice or sensitive information disclosure. (CVE-2019-19203)\n","status":"published","published":"2022-10-10T05:11:49Z","modified":"2026-06-29T13:49:42.239176223Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}