kritik
CVE-2019-19012
oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Photon OS. Daha düşük diyenler: Red Hat (orta), AlmaLinux (orta), Amazon (orta), Oracle (orta), Rocky Linux (orta), Ubuntu (orta).
Açıklama
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 2.0 | oniguruma | 6.9.3-1.ph2 |
| Photon OS 3.0 | oniguruma | 6.9.3-2.ph3 |
| alma 8 | oniguruma, oniguruma-devel, ruby:2.5::ruby ve 31 tane daha | 6.8.2-2.1.el8_9 ve 22 tane daha |
| amazon linux 2 | oniguruma, oniguruma-debuginfo, oniguruma-devel | 5.9.6-1.amzn2.0.3 |
| debian 10 | libonig | düzeltme belirtilmemiş |
| debian 11 | libonig | 6.9.4-1 |
| debian 12 | libonig | 6.9.4-1 |
| debian 13 | libonig | 6.9.4-1 |
| debian 14 | libonig | 6.9.4-1 |
| debian 8 | libonig | 5.9.5-3.2+deb8u4 |
| debian 9 | libonig | 6.1.3-2+deb9u1 |
| echo | libonig | 6.9.4-1 |
18 kaynaktaki 185 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 2.0 | oniguruma | 6.9.3-1.ph2 |
| Photon OS 3.0 | oniguruma | 6.9.3-2.ph3 |
| alma 8 | oniguruma | 6.8.2-2.1.el8_9 |
| alma 8 | oniguruma-devel | 6.8.2-2.1.el8_9 |
| alma 8 | ruby:2.5::ruby | 2.5.9-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::ruby-devel | 2.5.9-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::ruby-doc | 2.5.9-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::ruby-irb | 2.5.9-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::ruby-libs | 2.5.9-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-abrt | 0.3.0-4.module_el8.5.0+2625+ec418553 |
| alma 8 | ruby:2.5::rubygem-abrt-doc | 0.3.0-4.module_el8.10.0+3871+342e2c2f |
| alma 8 | ruby:2.5::rubygem-bigdecimal | 1.3.4-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-bson | 4.3.0-2.module_el8.5.0+2625+ec418553 |
| alma 8 | ruby:2.5::rubygem-bson-doc | 4.3.0-2.module_el8.5.0+2625+ec418553 |
| alma 8 | ruby:2.5::rubygem-bundler | 1.16.1-5.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-bundler-doc | 1.16.1-5.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-did_you_mean | 1.2.0-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-io-console | 0.4.6-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-json | 2.1.0-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-minitest | 5.10.3-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-mongo | 2.5.1-2.module_el8.5.0+2625+ec418553 |
| alma 8 | ruby:2.5::rubygem-mongo-doc | 2.5.1-2.module_el8.5.0+2625+ec418553 |
| alma 8 | ruby:2.5::rubygem-mysql2 | 0.4.10-4.module_el8.5.0+2625+ec418553 |
| alma 8 | ruby:2.5::rubygem-mysql2-doc | 0.4.10-4.module_el8.5.0+2625+ec418553 |
| alma 8 | ruby:2.5::rubygem-net-telnet | 0.1.1-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-openssl | 2.1.2-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-pg | 1.0.0-3.module_el8.9.0+3635+c6f99506 |
| alma 8 | ruby:2.5::rubygem-pg-doc | 1.0.0-3.module_el8.9.0+3635+c6f99506 |
| alma 8 | ruby:2.5::rubygem-power_assert | 1.1.1-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-psych | 3.0.2-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-rake | 12.3.3-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-rdoc | 6.0.1.1-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-test-unit | 3.2.7-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygem-xmlrpc | 0.3.0-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygems | 2.7.6.3-114.module_el8.10.0+3991+5e651d4e |
| alma 8 | ruby:2.5::rubygems-devel | 2.7.6.3-114.module_el8.10.0+3991+5e651d4e |
| amazon linux 2 | oniguruma | 5.9.6-1.amzn2.0.3 |
| amazon linux 2 | oniguruma-debuginfo | 5.9.6-1.amzn2.0.3 |
| amazon linux 2 | oniguruma-devel | 5.9.6-1.amzn2.0.3 |
| debian 10 | libonig | düzeltme belirtilmemiş |
| debian 11 | libonig | 6.9.4-1 |
| debian 12 | libonig | 6.9.4-1 |
| debian 13 | libonig | 6.9.4-1 |
| debian 14 | libonig | 6.9.4-1 |
| debian 8 | libonig | 5.9.5-3.2+deb8u4 |
| debian 9 | libonig | 6.1.3-2+deb9u1 |
| echo | libonig | 6.9.4-1 |
| Oracle Linux 8 | oniguruma | 6.8.2-2.1.el8_9 |
| Oracle Linux 8 | oniguruma-devel | 6.8.2-2.1.el8_9 |
| Oracle Linux 8 | ruby | 2.5.9-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | ruby-devel | 2.5.9-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | ruby-doc | 2.5.9-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | ruby-irb | 2.5.9-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | ruby-libs | 2.5.9-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-abrt | 0.3.0-4.module+el8.10.0+90367+ae9e8511 |
| Oracle Linux 8 | rubygem-abrt-doc | 0.3.0-4.module+el8.10.0+90367+ae9e8511 |
| Oracle Linux 8 | rubygem-bigdecimal | 1.3.4-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-bson | 4.3.0-2.module+el8.9.0+90042+a65659a6 |
| Oracle Linux 8 | rubygem-bson-doc | 4.3.0-2.module+el8.9.0+90042+a65659a6 |
| Oracle Linux 8 | rubygem-bundler | 1.16.1-5.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-bundler-doc | 1.16.1-5.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-did_you_mean | 1.2.0-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-io-console | 0.4.6-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-json | 2.1.0-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-minitest | 5.10.3-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-mongo | 2.5.1-2.module+el8.9.0+90042+a65659a6 |
| Oracle Linux 8 | rubygem-mongo-doc | 2.5.1-2.module+el8.9.0+90042+a65659a6 |
| Oracle Linux 8 | rubygem-mysql2 | 0.4.10-4.module+el8.9.0+90042+a65659a6 |
| Oracle Linux 8 | rubygem-mysql2-doc | 0.4.10-4.module+el8.9.0+90042+a65659a6 |
| Oracle Linux 8 | rubygem-net-telnet | 0.1.1-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-openssl | 2.1.2-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-pg | 1.0.0-3.module+el8.9.0+90042+a65659a6 |
| Oracle Linux 8 | rubygem-pg-doc | 1.0.0-3.module+el8.9.0+90042+a65659a6 |
| Oracle Linux 8 | rubygem-power_assert | 1.1.1-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-psych | 3.0.2-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-rake | 12.3.3-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-rdoc | 6.0.1.1-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-test-unit | 3.2.7-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygem-xmlrpc | 0.3.0-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygems | 2.7.6.3-114.module+el8.10.0+90580+29305b94 |
| Oracle Linux 8 | rubygems-devel | 2.7.6.3-114.module+el8.10.0+90580+29305b94 |
| Red Hat | oniguruma | düzeltme belirtilmemiş |
| Red Hat | oniguruma-devel | düzeltme belirtilmemiş |
| Red Hat | php | düzeltme belirtilmemiş |
| Red Hat | php-bcmath | düzeltme belirtilmemiş |
| Red Hat | php-cli | düzeltme belirtilmemiş |
| Red Hat | php-common | düzeltme belirtilmemiş |
| Red Hat | php-dba | düzeltme belirtilmemiş |
| Red Hat | php-devel | düzeltme belirtilmemiş |
| Red Hat | php-embedded | düzeltme belirtilmemiş |
| Red Hat | php-enchant | düzeltme belirtilmemiş |
| Red Hat | php-fpm | düzeltme belirtilmemiş |
| Red Hat | php-gd | düzeltme belirtilmemiş |
| Red Hat | php-imap | düzeltme belirtilmemiş |
| Red Hat | php-intl | düzeltme belirtilmemiş |
| Red Hat | php-ldap | düzeltme belirtilmemiş |
| Red Hat | php-mbstring | düzeltme belirtilmemiş |
| Red Hat | php-mysql | düzeltme belirtilmemiş |
| Red Hat | php-odbc | düzeltme belirtilmemiş |
| Red Hat | php-pdo | düzeltme belirtilmemiş |
| Red Hat | php-pgsql | düzeltme belirtilmemiş |
| Red Hat | php-process | düzeltme belirtilmemiş |
| Red Hat | php-pspell | düzeltme belirtilmemiş |
| Red Hat | php-recode | düzeltme belirtilmemiş |
| Red Hat | php-snmp | düzeltme belirtilmemiş |
| Red Hat | php-soap | düzeltme belirtilmemiş |
| Red Hat | php-tidy | düzeltme belirtilmemiş |
| Red Hat | php-xml | düzeltme belirtilmemiş |
| Red Hat | php-xmlrpc | düzeltme belirtilmemiş |
| Red Hat | php-zts | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::ruby | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::ruby-bundled-gems | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::ruby-default-gems | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::ruby-devel | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::ruby-doc | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::ruby-irb | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::ruby-libs | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-abrt | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-abrt-doc | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-bigdecimal | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-bson | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-bson-doc | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-bundler | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-bundler-doc | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-did_you_mean | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-io-console | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-irb | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-json | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-minitest | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-mongo | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-mongo-doc | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-mysql2 | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-mysql2-doc | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-net-telnet | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-openssl | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-pg | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-pg-doc | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-power_assert | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-psych | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-racc | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-rake | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-rbs | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-rdoc | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-rexml | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-rss | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-test-unit | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-typeprof | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygem-xmlrpc | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygems | düzeltme belirtilmemiş |
| Red Hat | ruby:2.6::rubygems-devel | düzeltme belirtilmemiş |
| rocky 8 | ruby:2.5::ruby | 2.5.9-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::ruby-devel | 2.5.9-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::ruby-doc | 2.5.9-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::ruby-irb | 2.5.9-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::ruby-libs | 2.5.9-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-abrt | 0.3.0-4.module+el8.9.0+1536+5f79634e |
| rocky 8 | ruby:2.5::rubygem-abrt-doc | 0.3.0-4.module+el8.9.0+1536+5f79634e |
| rocky 8 | ruby:2.5::rubygem-bigdecimal | 1.3.4-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-bson | 4.3.0-2.module+el8.9.0+1536+5f79634e |
| rocky 8 | ruby:2.5::rubygem-bson-doc | 4.3.0-2.module+el8.9.0+1536+5f79634e |
| rocky 8 | ruby:2.5::rubygem-bundler | 1.16.1-5.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-bundler-doc | 1.16.1-5.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-did_you_mean | 1.2.0-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-io-console | 0.4.6-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-json | 2.1.0-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-minitest | 5.10.3-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-mongo | 2.5.1-2.module+el8.9.0+1536+5f79634e |
| rocky 8 | ruby:2.5::rubygem-mongo-doc | 2.5.1-2.module+el8.9.0+1536+5f79634e |
| rocky 8 | ruby:2.5::rubygem-mysql2 | 0.4.10-4.module+el8.9.0+1536+5f79634e |
| rocky 8 | ruby:2.5::rubygem-mysql2-doc | 0.4.10-4.module+el8.9.0+1536+5f79634e |
| rocky 8 | ruby:2.5::rubygem-net-telnet | 0.1.1-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-openssl | 2.1.2-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-pg | 1.0.0-3.module+el8.9.0+1536+5f79634e |
| rocky 8 | ruby:2.5::rubygem-pg-doc | 1.0.0-3.module+el8.9.0+1536+5f79634e |
| rocky 8 | ruby:2.5::rubygem-power_assert | 1.1.1-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-psych | 3.0.2-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-rake | 12.3.3-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-rdoc | 6.0.1.1-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-test-unit | 3.2.7-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygem-xmlrpc | 0.3.0-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygems | 2.7.6.3-114.module+el8.10.0+1979+815637df |
| rocky 8 | ruby:2.5::rubygems-devel | 2.7.6.3-114.module+el8.10.0+1979+815637df |
| ubuntu 14.04-ESM | libonig | 5.9.1-1ubuntu1.1+esm2 |
| ubuntu 16.04-ESM | libonig | 5.9.6-1ubuntu0.1+esm2 |
| ubuntu 18.04-ESM | libonig | 6.7.0-1ubuntu0.1~esm2 |
Referanslar
- https://access.redhat.com/errata/RHSA-2025:7539
- https://access.redhat.com/security/cve/CVE-2019-19012
- https://bugzilla.redhat.com/1802051
- https://bugzilla.redhat.com/2035260
- https://bugzilla.redhat.com/show_bug.cgi?id=1802051
- https://bugzilla.redhat.com/show_bug.cgi?id=2035260
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19012
24 referansın hepsi
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43809
- https://errata.almalinux.org/8/ALSA-2025-7539.html
- https://errata.rockylinux.org/RLSA-2025:7539
- https://github.com/kkos/oniguruma/issues/164
- https://github.com/kkos/oniguruma/releases/tag/v6.9.4_rc2
- https://github.com/tarantula-team/CVE-2019-19012
- https://linux.oracle.com/cve/CVE-2019-19012.html
- https://linux.oracle.com/errata/ELSA-2025-7539.html
- https://lists.debian.org/debian-lts-announce/2019/12/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NO267PLHGYZSWX3XTRPKYBKD4J3YOU5V/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3MBNW6Z4DOXSCNWGBLQ7OA3OGUJ44WL/
- https://nvd.nist.gov/vuln/detail/CVE-2019-19012
- https://ubuntu.com/security/notices/USN-4460-1
- https://ubuntu.com/security/notices/USN-5662-1
- https://usn.ubuntu.com/4460-1/
- https://www.cve.org/CVERecord?id=CVE-2019-19012