CVE-2019-13224: Use After Free
A use-after-free in onignewdeluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onignewdeluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
Other sources
Fixed CVE-2019-13224 (don't allow different encodings for onignewdeluxe) (stas)
— PHP
oniguruma is vulnerable to a denial of service, caused by a use-after-free in onignewdeluxe() in regext.c. By persuading a victim to compile a specially crafted file and execute its object code, a remote attacker could exploit this vulnerability to achieve information disclosure, denial of service, or possibly code execution
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-13224.
What is the severity of CVE-2019-13224?
The severity of CVE-2019-13224 is medium with a CVSS score of 6.8.
What is the affected software?
The affected software is PHP version up to exclusive 7.1.32.
What is the impact of CVE-2019-13224?
The impact of CVE-2019-13224 can include information disclosure, denial of service, or possibly code execution.
How can I fix CVE-2019-13224?
To fix CVE-2019-13224, update to PHP version 7.1.32 or later.