CVE-2019-19204

Oniguruma 6.x before 6.9.4_rc2 is affected. In regparse.c, fetch_interval_quantifier calls PFETCH without verifying PEND, causing a heap-based buffer over-read. This is documented across multiple advisories (e.g., Debian/ALMALINUX/Amazon Linux) and is fixed in 6.9.4_rc2 and later releases. Affect...