CVE-2019-13224

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-13224
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-13224.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-13224
Downstream
ALPINE (1)
ALSA (2)
BELL (1)
CLSA (3)
DEBIAN (1)
MGASA (2)
openSUSE (1)
RHSA (4)
RLSA (1)
SUSE (1)
UBUNTU (1)
Related
ALSA (2)
openSUSE (1)
SUSE (1)
Published
2019-07-10T14:15:11Z
Modified
2026-10-24T14:03:37Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "12.04"
                        },
                        {
                            "last_affected": "12.04"
                        },
                        {
                            "introduced": "14.04"
                        },
                        {
                            "last_affected": "14.04"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "canonical:ubuntu_linux"
        },
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "8.0"
                        },
                        {
                            "last_affected": "8.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "debian:debian_linux"
        },
        {
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "29"
                        },
                        {
                            "last_affected": "29"
                        },
                        {
                            "introduced": "30"
                        },
                        {
                            "last_affected": "30"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "fedoraproject:fedora"
        }
    ]
}
References

Affected packages

Git / github.com/kkos/oniguruma

Affected ranges

Type
GIT
Repo
https://github.com/kkos/oniguruma
Events
Introduced
83572e983928243d741f61ac290fc057d69fefc3
Last Affected
83572e983928243d741f61ac290fc057d69fefc3
Fixed
0f7f61ed1b7b697e283e37bd2d731d0bd57adb55
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:oniguruma_project:oniguruma:6.9.2:-:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "6.9.2-NA"
                },
                {
                    "last_affected": "6.9.2-NA"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "range": [
                {
                    "fixed": "0f7f61ed1b7b697e283e37bd2d731d0bd57adb55"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

6.*
6.9.2-NA
v6.*
v6.9.2
v6.9.2_rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-13224.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "144477375847041035196488014531602342496",
                "39487835141121000899975727629951651164",
                "243574904145470851950892010676215846309",
                "261101043450223522914619713906777460104",
                "192845130568107495712244117068883375560",
                "38824287918157113434026198298701563168",
                "44502028448723226475273193052058068900",
                "57330471737783644434537330796049609549",
                "265399586591815778503620908494229098639",
                "17751534671408493758106039438651136950",
                "42363307028960740653651765099861536532"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2019-13224-69a60e05",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55",
        "target": {
            "file": "src/regext.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "16716532786252836573114105484968648519",
            "length": 884
        },
        "id": "CVE-2019-13224-b47700ae",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55",
        "target": {
            "file": "src/regext.c",
            "function": "onig_new_deluxe"
        }
    }
]
vanir_signatures_modified 
"2026-10-24T14:03:37Z"

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
0221e9f827632942225586687a33cfd554860d5e
Fixed
481520d3819b0b68b65539ff59b4bd2f018d6e5f
Introduced
8148cbb78841c8ec0759c0836e7f35dec799d300
Fixed
b4140bf64811b97af153a5d49a1d71677993a075
Introduced
52ace952a1b65ca80fc2617f11c2fa6dd03f51bd
Fixed
89dc78e0f0c1a4f27b889f232b109a3919ecf478
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.1.0"
                },
                {
                    "fixed": "7.1.32"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.2.0"
                },
                {
                    "fixed": "7.2.23"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.3.0"
                },
                {
                    "fixed": "7.3.9"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-13224.json"