blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2019-13224

CRITICAL 9.8 CVSS 3.1
Published
July 10, 2019
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-416
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

Affected products and versions

  • PHP — From 7.1.0 (including) to 7.1.32 (excluding)
  • PHP — From 7.2.0 (including) to 7.2.23 (excluding)
  • PHP — From 7.3.0 (including) to 7.3.9 (excluding)

References

  • github.com https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55 Patch, Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2019/07/msg00013.html Mailing List, Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWCPDTZOIUKGMFAD5NAKUB7FPJFAIQN5/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNL26OZSQRVLEO6JRNUVIMZTICXBNEQW/
  • security.gentoo.org https://security.gentoo.org/glsa/201911-03 Third Party Advisory
  • support.f5.com https://support.f5.com/csp/article/K00103182 Third Party Advisory
  • support.f5.com https://support.f5.com/csp/article/K00103182?utm_source=f5support&amp%3Butm_medium=RSS
  • usn.ubuntu.com https://usn.ubuntu.com/4088-1/ Third Party Advisory
  • nvd.nist.gov Official NVD record