CVE-2019-13225: Null Pointer Dereference
A NULL Pointer Dereference in matchat() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression. Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-13225?
CVE-2019-13225 is a vulnerability in the Oniguruma library that allows attackers to potentially cause denial of service by providing a crafted regular expression.
Which software is affected by CVE-2019-13225?
Oniguruma 6.9.2 is affected by CVE-2019-13225. It often affects Ruby, as well as common optional libraries for PHP and Rust.
What is the severity of CVE-2019-13225?
The severity of CVE-2019-13225 is medium, with a severity value of 6.5.
How can I fix CVE-2019-13225?
To fix CVE-2019-13225, update the Oniguruma library to version 6.9.3 or higher.
Where can I find more information about CVE-2019-13225?
You can find more information about CVE-2019-13225 in the references provided: - [https://github.com/kkos/oniguruma/commit/c509265c5f6ae7264f7b8a8aae1cfa5fc59d108c](https://github.com/kkos/oniguruma/commit/c509265c5f6ae7264f7b8a8aae1cfa5fc59d108c) - [https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1728967](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1728967) - [https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1728966](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1728966)