critical
CVE-2019-9023
php: Heap-based buffer over-read in mbstring regular expression functions
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by AlmaLinux (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (medium), Red Hat (low).
Description
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | php:7.2::apcu-panel, php:7.2::libzip, php:7.2::libzip-devel and 32 more | 5.1.12-2.module_el8.3.0+2010+7c76a223 and 4 more |
| alpine 3.10 | php7 | 7.2.14-r0 |
| alpine 3.11 | php7 | 7.2.14-r0 |
| alpine 3.12 | php7 | 7.2.14-r0 |
| alpine 3.13 | php7 | 7.2.14-r0 |
| alpine 3.14 | php7 | 7.2.14-r0 |
| alpine 3.15 | php7 | 7.2.14-r0 |
| alpine 3.8 | php7 | 7.2.17-r0 |
| alpine 3.9 | php7 | 7.2.14-r0 |
| debian 8 | php5 | 5.6.40+dfsg-0+deb8u1 |
| debian 9 | php7.0 | 7.0.33-0+deb9u2 |
| Oracle Linux 8 | apcu-panel, libzip, libzip-devel and 32 more | 5.1.12-2.module+el8.2.0+5510+6771133c and 4 more |
Show all 177 entries from 21 sources
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | php:7.2::apcu-panel | 5.1.12-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::libzip | 1.5.1-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::libzip-devel | 1.5.1-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::libzip-tools | 1.5.1-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-bcmath | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-cli | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-common | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-dba | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-dbg | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-devel | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-embedded | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-enchant | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-fpm | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-gd | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-gmp | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-intl | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-json | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-ldap | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-mbstring | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-mysqlnd | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-odbc | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-opcache | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pdo | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pear | 1:1.10.5-9.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pecl-apcu | 5.1.12-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pecl-apcu-devel | 5.1.12-2.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pecl-zip | 1.15.3-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-pgsql | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-process | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-recode | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-snmp | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-soap | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-xml | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alma 8 | php:7.2::php-xmlrpc | 7.2.24-1.module_el8.3.0+2010+7c76a223 |
| alpine 3.10 | php7 | 7.2.14-r0 |
| alpine 3.11 | php7 | 7.2.14-r0 |
| alpine 3.12 | php7 | 7.2.14-r0 |
| alpine 3.13 | php7 | 7.2.14-r0 |
| alpine 3.14 | php7 | 7.2.14-r0 |
| alpine 3.15 | php7 | 7.2.14-r0 |
| alpine 3.8 | php7 | 7.2.17-r0 |
| alpine 3.9 | php7 | 7.2.14-r0 |
| debian 8 | php5 | 5.6.40+dfsg-0+deb8u1 |
| debian 9 | php7.0 | 7.0.33-0+deb9u2 |
| Oracle Linux 8 | apcu-panel | 5.1.12-2.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | libzip | 1.5.1-2.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | libzip-devel | 1.5.1-2.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | libzip-tools | 1.5.1-2.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-bcmath | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-cli | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-common | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-dba | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-dbg | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-devel | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-embedded | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-enchant | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-fpm | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-gd | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-gmp | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-intl | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-json | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-ldap | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-mbstring | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-mysqlnd | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-odbc | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-opcache | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-pdo | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-pear | 1:1.10.5-9.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-pecl-apcu | 5.1.12-2.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-pecl-apcu-devel | 5.1.12-2.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-pecl-zip | 1.15.3-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-pgsql | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-process | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-recode | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-snmp | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-soap | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-xml | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Oracle Linux 8 | php-xmlrpc | 7.2.24-1.module+el8.2.0+5510+6771133c |
| Red Hat | php | no fix listed |
| Red Hat | php-bcmath | no fix listed |
| Red Hat | php-cli | no fix listed |
| Red Hat | php-common | no fix listed |
| Red Hat | php-dba | no fix listed |
| Red Hat | php-devel | no fix listed |
| Red Hat | php-embedded | no fix listed |
| Red Hat | php-enchant | no fix listed |
| Red Hat | php-fpm | no fix listed |
| Red Hat | php-gd | no fix listed |
| Red Hat | php-imap | no fix listed |
| Red Hat | php-intl | no fix listed |
| Red Hat | php-ldap | no fix listed |
| Red Hat | php-mbstring | no fix listed |
| Red Hat | php-mysql | no fix listed |
| Red Hat | php-mysqlnd | no fix listed |
| Red Hat | php-odbc | no fix listed |
| Red Hat | php-pdo | no fix listed |
| Red Hat | php-pgsql | no fix listed |
| Red Hat | php-process | no fix listed |
| Red Hat | php-pspell | no fix listed |
| Red Hat | php-recode | no fix listed |
| Red Hat | php-snmp | no fix listed |
| Red Hat | php-soap | no fix listed |
| Red Hat | php-tidy | no fix listed |
| Red Hat | php-xml | no fix listed |
| Red Hat | php-xmlrpc | no fix listed |
| Red Hat | php-zts | no fix listed |
| rocky 8 | php | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-bcmath | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-cli | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-common | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-dba | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-dbg | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-devel | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-embedded | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-enchant | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-fpm | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-gd | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-gmp | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-intl | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-json | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-ldap | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-mbstring | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-mysqlnd | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-odbc | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-opcache | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-pdo | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-pgsql | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-process | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-recode | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-snmp | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-soap | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-xml | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php-xmlrpc | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::apcu-panel | 5.1.12-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::libzip | 1.5.1-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::libzip-devel | 1.5.1-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::libzip-tools | 1.5.1-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-bcmath | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-cli | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-common | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-dba | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-dbg | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-devel | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-embedded | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-enchant | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-fpm | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-gd | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-gmp | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-intl | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-json | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-ldap | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-mbstring | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-mysqlnd | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-odbc | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-opcache | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pdo | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pear | 1:1.10.5-9.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pecl-apcu | 5.1.12-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pecl-apcu-devel | 5.1.12-2.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pecl-zip | 1.15.3-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-pgsql | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-process | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-recode | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-snmp | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-soap | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-xml | 7.2.24-1.module+el8.4.0+413+c9202dda |
| rocky 8 | php:7.2::php-xmlrpc | 7.2.24-1.module+el8.4.0+413+c9202dda |
| ubuntu 14.04 | php5 | 5.5.9+dfsg-1ubuntu4.27 |
| ubuntu 14.04-ESM | php5 | 5.5.9+dfsg-1ubuntu4.27 |
| ubuntu 16.04 | php7.0 | 7.0.33-0ubuntu0.16.04.2 |
| ubuntu 16.04-ESM | php7.0 | 7.0.33-0ubuntu0.16.04.2 |
| ubuntu 18.04 | php7.2 | 7.2.15-0ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | php7.2 | 7.2.15-0ubuntu0.18.04.1 |
| ubuntu 18.10 | php7.2 | 7.2.15-0ubuntu0.18.10.1 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html
- http://www.securityfocus.com/bid/107156
- https://access.redhat.com/errata/RHSA-2019:2519
- https://access.redhat.com/errata/RHSA-2019:3299
- https://access.redhat.com/security/cve/CVE-2019-9023
All 62 references
- https://bugs.php.net/bug.php?id=77370
- https://bugs.php.net/bug.php?id=77371
- https://bugs.php.net/bug.php?id=77381
- https://bugs.php.net/bug.php?id=77382
- https://bugs.php.net/bug.php?id=77385
- https://bugs.php.net/bug.php?id=77394
- https://bugs.php.net/bug.php?id=77418
- https://bugzilla.redhat.com/show_bug.cgi?id=1680545
- https://bugzilla.redhat.com/show_bug.cgi?id=1685123
- https://bugzilla.redhat.com/show_bug.cgi?id=1685132
- https://bugzilla.redhat.com/show_bug.cgi?id=1685398
- https://bugzilla.redhat.com/show_bug.cgi?id=1685404
- https://bugzilla.redhat.com/show_bug.cgi?id=1685412
- https://bugzilla.redhat.com/show_bug.cgi?id=1688897
- https://bugzilla.redhat.com/show_bug.cgi?id=1688922
- https://bugzilla.redhat.com/show_bug.cgi?id=1688934
- https://bugzilla.redhat.com/show_bug.cgi?id=1688939
- https://bugzilla.redhat.com/show_bug.cgi?id=1702246
- https://bugzilla.redhat.com/show_bug.cgi?id=1702256
- https://bugzilla.redhat.com/show_bug.cgi?id=1707299
- https://bugzilla.redhat.com/show_bug.cgi?id=1724152
- https://bugzilla.redhat.com/show_bug.cgi?id=1724154
- https://bugzilla.redhat.com/show_bug.cgi?id=1739459
- https://bugzilla.redhat.com/show_bug.cgi?id=1739465
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20783
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11034
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11035
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11036
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11039
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11040
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11041
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11042
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9020
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9021
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9022
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9023
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9024
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9637
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9638
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9639
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9640
- https://errata.almalinux.org/8/ALSA-2020-1624.html
- https://errata.rockylinux.org/RLSA-2020:1624
- https://linux.oracle.com/cve/CVE-2019-9023.html
- https://linux.oracle.com/errata/ELSA-2020-1624.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-9023
- https://security.netapp.com/advisory/ntap-20190321-0001/
- https://support.f5.com/csp/article/K06372014
- https://ubuntu.com/security/notices/USN-3902-1
- https://ubuntu.com/security/notices/USN-3902-2
- https://usn.ubuntu.com/3902-1/
- https://usn.ubuntu.com/3902-2/
- https://www.cve.org/CVERecord?id=CVE-2019-9023
- https://www.debian.org/security/2019/dsa-4398