CVE-2019-19246
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2019-19246
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19246.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2019-19246
- Downstream
- Related
- Published
- 2019-11-25T17:15:11Z
- Modified
- 2025-10-24T11:58:53.457410Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in strlowercase_match in regexec.c.
- References
-
- https://bugs.php.net/bug.php?id=78559
- https://github.com/kkos/oniguruma/commit/d3e402928b6eb3327f8f7d59a9edfa622fec557b
- https://lists.debian.org/debian-lts-announce/2019/12/msg00002.html
- https://usn.ubuntu.com/4460-1/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NO267PLHGYZSWX3XTRPKYBKD4J3YOU5V/
Affected packages
Git / github.com/kkos/oniguruma
Affected ranges
- Type
- GIT
- Repo
- https://github.com/kkos/oniguruma
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
v5.*
v5.9.6
v6.*
v6.0.0
v6.1.0
v6.1.1
v6.1.2
v6.1.3
v6.2.0
v6.3.0
v6.4.0
v6.5.0
v6.6.0
v6.6.1
v6.7.0
v6.7.1
v6.8.0
v6.8.1
v6.8.2
v6.9.0
v6.9.1
v6.9.2
v6.9.2_rc1
v6.9.2_rc2
v6.9.2_rc3
v6.9.3
Database specific
vanir_signatures
[
{
"source": "https://github.com/kkos/oniguruma/commit/d3e402928b6eb3327f8f7d59a9edfa622fec557b",
"target": {
"file": "src/regexec.c"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2019-19246-ee72ec58",
"signature_type": "Line",
"digest": {
"line_hashes": [
"62515007490554007865331787131035268207",
"73060259964332736538643090030886107933",
"240203263475203359359784711152491354249",
"158627744619430761962932360405786758087"
],
"threshold": 0.9
}
},
{
"source": "https://github.com/kkos/oniguruma/commit/d3e402928b6eb3327f8f7d59a9edfa622fec557b",
"target": {
"function": "str_lower_case_match",
"file": "src/regexec.c"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2019-19246-f787398e",
"signature_type": "Function",
"digest": {
"function_hash": "301772738909245608982934055287646460906",
"length": 390.0
}
}
]