crítica
CVE-2019-9023
php: Heap-based buffer over-read in mbstring regular expression functions
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según AlmaLinux (media), Oracle (media), Rocky Linux (media), Ubuntu (media), Red Hat (baja).
Descripción
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | php:7.2::apcu-panel, php:7.2::libzip, php:7.2::libzip-devel y 32 más | 5.1.12-2.module_el8.3.0+2010+7c76a223 y 4 más |
| alpine 3.10 | php7 | 7.2.14-r0 |
| alpine 3.11 | php7 | 7.2.14-r0 |
| alpine 3.12 | php7 | 7.2.14-r0 |
| alpine 3.13 | php7 | 7.2.14-r0 |
| alpine 3.14 | php7 | 7.2.14-r0 |
| alpine 3.15 | php7 | 7.2.14-r0 |
| alpine 3.8 | php7 | 7.2.17-r0 |
| alpine 3.9 | php7 | 7.2.14-r0 |
| debian 8 | php5 | 5.6.40+dfsg-0+deb8u1 |
| debian 9 | php7.0 | 7.0.33-0+deb9u2 |
| Oracle Linux 8 | apcu-panel, libzip, libzip-devel y 32 más | 5.1.12-2.module+el8.2.0+5510+6771133c y 4 más |
Mostrar las 177 entradas de 21 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | php:7.2::apcu-panel | 5.1.12-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::libzip | 1.5.1-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::libzip-devel | 1.5.1-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::libzip-tools | 1.5.1-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-bcmath | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-cli | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-common | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-dba | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-dbg | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-devel | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-embedded | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-enchant | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-fpm | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-gd | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-gmp | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-intl | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-json | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-ldap | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-mbstring | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-mysqlnd | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-odbc | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-opcache | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pdo | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pear | 1:1.10.5-9.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pecl-apcu | 5.1.12-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pecl-apcu-devel | 5.1.12-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pecl-zip | 1.15.3-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pgsql | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-process | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-recode | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-snmp | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-soap | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-xml | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-xmlrpc | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alpine 3.10 | php7 | 7.2.14-r0 |
| alpine 3.11 | php7 | 7.2.14-r0 |
| alpine 3.12 | php7 | 7.2.14-r0 |
| alpine 3.13 | php7 | 7.2.14-r0 |
| alpine 3.14 | php7 | 7.2.14-r0 |
| alpine 3.15 | php7 | 7.2.14-r0 |
| alpine 3.8 | php7 | 7.2.17-r0 |
| alpine 3.9 | php7 | 7.2.14-r0 |
| debian 8 | php5 | 5.6.40+dfsg-0+deb8u1 |
| debian 9 | php7.0 | 7.0.33-0+deb9u2 |
| Oracle Linux 8 | apcu-panel | 5.1.12-2.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | libzip | 1.5.1-2.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | libzip-devel | 1.5.1-2.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | libzip-tools | 1.5.1-2.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-bcmath | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-cli | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-common | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-dba | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-dbg | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-devel | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-embedded | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-enchant | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-fpm | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-gd | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-gmp | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-intl | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-json | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-ldap | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-mbstring | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-mysqlnd | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-odbc | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-opcache | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-pdo | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-pear | 1:1.10.5-9.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-pecl-apcu | 5.1.12-2.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-pecl-apcu-devel | 5.1.12-2.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-pecl-zip | 1.15.3-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-pgsql | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-process | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-recode | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-snmp | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-soap | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-xml | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-xmlrpc | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Red Hat | php | sin corrección indicada |
| Red Hat | php-bcmath | sin corrección indicada |
| Red Hat | php-cli | sin corrección indicada |
| Red Hat | php-common | sin corrección indicada |
| Red Hat | php-dba | sin corrección indicada |
| Red Hat | php-devel | sin corrección indicada |
| Red Hat | php-embedded | sin corrección indicada |
| Red Hat | php-enchant | sin corrección indicada |
| Red Hat | php-fpm | sin corrección indicada |
| Red Hat | php-gd | sin corrección indicada |
| Red Hat | php-imap | sin corrección indicada |
| Red Hat | php-intl | sin corrección indicada |
| Red Hat | php-ldap | sin corrección indicada |
| Red Hat | php-mbstring | sin corrección indicada |
| Red Hat | php-mysql | sin corrección indicada |
| Red Hat | php-mysqlnd | sin corrección indicada |
| Red Hat | php-odbc | sin corrección indicada |
| Red Hat | php-pdo | sin corrección indicada |
| Red Hat | php-pgsql | sin corrección indicada |
| Red Hat | php-process | sin corrección indicada |
| Red Hat | php-pspell | sin corrección indicada |
| Red Hat | php-recode | sin corrección indicada |
| Red Hat | php-snmp | sin corrección indicada |
| Red Hat | php-soap | sin corrección indicada |
| Red Hat | php-tidy | sin corrección indicada |
| Red Hat | php-xml | sin corrección indicada |
| Red Hat | php-xmlrpc | sin corrección indicada |
| Red Hat | php-zts | sin corrección indicada |
| rocky 8 | php | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-bcmath | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-cli | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-common | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-dba | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-dbg | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-devel | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-embedded | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-enchant | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-fpm | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-gd | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-gmp | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-intl | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-json | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-ldap | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-mbstring | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-mysqlnd | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-odbc | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-opcache | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-pdo | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-pgsql | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-process | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-recode | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-snmp | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-soap | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-xml | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-xmlrpc | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::apcu-panel | 5.1.12-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::libzip | 1.5.1-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::libzip-devel | 1.5.1-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::libzip-tools | 1.5.1-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-bcmath | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-cli | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-common | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-dba | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-dbg | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-devel | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-embedded | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-enchant | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-fpm | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-gd | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-gmp | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-intl | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-json | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-ldap | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-mbstring | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-mysqlnd | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-odbc | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-opcache | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pdo | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pear | 1:1.10.5-9.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pecl-apcu | 5.1.12-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pecl-apcu-devel | 5.1.12-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pecl-zip | 1.15.3-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pgsql | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-process | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-recode | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-snmp | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-soap | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-xml | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-xmlrpc | 7.2.24-1.module+el8.4.0+413+c9202dda |
| ubuntu 14.04 | php5 | 5.5.9+dfsg-1ubuntu4.27 |
| ubuntu 14.04-ESM | php5 | 5.5.9+dfsg-1ubuntu4.27 |
| ubuntu 16.04 | php7.0 | 7.0.33-0ubuntu0.16.04.2 |
| ubuntu 16.04-ESM | php7.0 | 7.0.33-0ubuntu0.16.04.2 |
| ubuntu 18.04 | php7.2 | 7.2.15-0ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | php7.2 | 7.2.15-0ubuntu0.18.04.1 |
| ubuntu 18.10 | php7.2 | 7.2.15-0ubuntu0.18.10.1 |
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html
- http://www.securityfocus.com/bid/107156
- https://access.redhat.com/errata/RHSA-2019:2519
- https://access.redhat.com/errata/RHSA-2019:3299
- https://access.redhat.com/security/cve/CVE-2019-9023
Las 62 referencias
- https://bugs.php.net/bug.php?id=77370
- https://bugs.php.net/bug.php?id=77371
- https://bugs.php.net/bug.php?id=77381
- https://bugs.php.net/bug.php?id=77382
- https://bugs.php.net/bug.php?id=77385
- https://bugs.php.net/bug.php?id=77394
- https://bugs.php.net/bug.php?id=77418
- https://bugzilla.redhat.com/show_bug.cgi?id=1680545
- https://bugzilla.redhat.com/show_bug.cgi?id=1685123
- https://bugzilla.redhat.com/show_bug.cgi?id=1685132
- https://bugzilla.redhat.com/show_bug.cgi?id=1685398
- https://bugzilla.redhat.com/show_bug.cgi?id=1685404
- https://bugzilla.redhat.com/show_bug.cgi?id=1685412
- https://bugzilla.redhat.com/show_bug.cgi?id=1688897
- https://bugzilla.redhat.com/show_bug.cgi?id=1688922
- https://bugzilla.redhat.com/show_bug.cgi?id=1688934
- https://bugzilla.redhat.com/show_bug.cgi?id=1688939
- https://bugzilla.redhat.com/show_bug.cgi?id=1702246
- https://bugzilla.redhat.com/show_bug.cgi?id=1702256
- https://bugzilla.redhat.com/show_bug.cgi?id=1707299
- https://bugzilla.redhat.com/show_bug.cgi?id=1724152
- https://bugzilla.redhat.com/show_bug.cgi?id=1724154
- https://bugzilla.redhat.com/show_bug.cgi?id=1739459
- https://bugzilla.redhat.com/show_bug.cgi?id=1739465
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20783
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11034
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11035
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11036
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11039
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11040
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11041
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11042
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9020
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9021
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9022
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9023
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9024
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9637
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9638
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9639
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9640
- https://errata.almalinux.org/8/ALSA-2020-1624.html
- https://errata.rockylinux.org/RLSA-2020:1624
- https://linux.oracle.com/cve/CVE-2019-9023.html
- https://linux.oracle.com/errata/ELSA-2020-1624.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-9023
- https://security.netapp.com/advisory/ntap-20190321-0001/
- https://support.f5.com/csp/article/K06372014
- https://ubuntu.com/security/notices/USN-3902-1
- https://ubuntu.com/security/notices/USN-3902-2
- https://usn.ubuntu.com/3902-1/
- https://usn.ubuntu.com/3902-2/
- https://www.cve.org/CVERecord?id=CVE-2019-9023
- https://www.debian.org/security/2019/dsa-4398