CVE-2019-19203: Buffer Overflow
An issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function gb18030mbcenclen in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.
Other sources
An out-of-bounds read vulnerability was found in the way Oniguruma handled regular expressions with GB18030 character encoding. A UChar pointer is dereferenced without checking if it passed the end of the matched string, leading to a heap-based buffer over-read. A remote attacker could abuse this flaw by providing a malformed regular expression that, when processed by an application linked to Oniguruma, might crash the application causing a denial of service.
Oniguruma is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the function gb18030mbcenclen in file gb18030.c. By using a specially-crafted input, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2019-19203.
What is the severity level of CVE-2019-19203?
The severity level of CVE-2019-19203 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-19203?
Oniguruma versions between 6.0.0 and 6.9.4 are affected by CVE-2019-19203.
How can I fix CVE-2019-19203?
Update Oniguruma to version 6.9.4 or later to fix CVE-2019-19203.
Where can I find more information about CVE-2019-19203?
You can find more information about CVE-2019-19203 on the GitHub issues page and release tag, as well as on the provided reference links.