CVE-2019-19204: Buffer Overflow
An issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function fetchintervalquantifier (formerly known as fetchrangequantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read.
Other sources
An out-of-bounds read vulnerability was found in Oniguruma in the way it handled regular expression quantifiers. A remote attacker could abuse this flaw by providing a malformed regular expression that, when processed by an application linked to Oniguruma, could possibly crash the application, resulting in a denial of service.
Oniguruma is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the function fetchintervalquantifier in regparse.c. By using a specially-crafted input, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-19204?
CVE-2019-19204 is an out-of-bounds read vulnerability in the Oniguruma library.
How does CVE-2019-19204 affect me?
If you are using an application linked to the Oniguruma library, a remote attacker could crash the application by providing a malformed regular expression.
What is the severity of CVE-2019-19204?
CVE-2019-19204 has a severity rating of 7, indicating a high severity.
How do I fix CVE-2019-19204?
To fix CVE-2019-19204, you should update the affected software to version 6.9.4 or later.
Where can I find more information about CVE-2019-19204?
You can find more information about CVE-2019-19204 on the CVE website (https://www.cve.org/CVERecord?id=CVE-2019-19204) and the NVD website (https://nvd.nist.gov/vuln/detail/CVE-2019-19204).