CVE-2019-19204

CVE-2019-19204 In Oniguruma 6.x vor 6.9.4rc2 wurde ein Problem entdeckt. In der Funktion fetchintervalquantifier früher bekannt als fetchrangequantifier in regparse.c wird PFETCH aufgerufen, ohne PEND zu prüfen. Dies führt zu einem heap-basierten Pufferüberlesen. Forscher: ManhND des The Tarantul...

CVE-2019-19204

CVE-2019-19204 Um problema foi descoberto no Oniguruma 6.x anterior a 6.9.4rc2. Na função fetchintervalquantifier anteriormente conhecida como fetchrangequantifier em regparse.c, PFETCH é chamado sem verificar PEND. Isso leva a uma leitura além do limite do buffer baseada em heap. Pesquisador:...

CVE-2019-19203

CVE-2019-19203 In Oniguruma 6.x vor 6.9.4rc2 wurde ein Problem entdeckt. In der Funktion gb18030mbcenclen in der Datei gb18030.c wird ein UChar-Zeiger dereferenziert, ohne zu prüfen, ob er das Ende der gefundenen Zeichenkette überschritten hat. Dies führt zu einem Heap-basierten Pufferüberlesen...

CVE-2019-19012

Overflow di interi in Oniguruma Un overflow di interi nella funzione searchinrange in regexec.c in Oniguruma 6.x precedente a 6.9.4rc2 porta a una lettura fuori dai limiti, in cui l'offset di questa lettura è sotto il controllo di un attaccante. Questo riguarda solo la versione compilata a 32 bit...

CVE-2019-19203

CVE-2019-19203 È stato scoperto un problema in Oniguruma 6.x prima della versione 6.9.4rc2. Nella funzione gb18030mbcenclen nel file gb18030.c, un puntatore UChar viene dereferenziato senza verificare se ha superato la fine della stringa corrispondente. Ciò porta a una lettura eccessiva del buffe...

CVE-2019-19012

CVE-2019-19012 Un overflow di interi nella funzione searchinrange in regexec.c in Oniguruma 6.x prima di 6.9.4rc2 porta a una lettura fuori dai limiti, in cui l'offset di questa lettura è sotto il controllo di un attaccante. Questo riguarda solo la versione compilata a 32 bit. Gli attaccanti remo...

Astra Linux – Vulnerability in libonig

A use-after-free in the onignewdeluxe function in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regular expression pattern and a...

Astra Linux – Vulnerability in libonig

A issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function gb18030mbcenclen in the file gb18030.c, a UChar pointer was dereferenced without checking whether it pointed to the end of the matched string. This resulted in a buffer overflow...

Astra Linux – Vulnerability in libonig

A NULL pointer dereference in the matchat function in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause a denial of service by providing a crafted regular expression. Oniguruma vulnerabilities often affect Ruby, as well as common optional libraries used in PHP and Rust...

Astra Linux – Vulnerability in libonig

A issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function fetchintervalquantifier formerly known as fetchrangequantifier in regparse.c, PFETCH is called without checking PEND. This leads to a buffer overflow issue based on the heap mechanism...

php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

A flaw was found in PHP. When an attacker input can influence the encoding passed to mbregexencoding and the application subsequently uses mbregex search APIs, a NULL pointer dereference can occur due to a mismatch between the Oniguruma and mbfl encoding support. This issue can cause a crash in t...

The vulnerability of the mbregexuringencoding() function in the PHP interpreter allows a hacker to trigger a service failure.

The vulnerability of the mbregexuringencoding function in the PHP interpreter is related to discrepancies in the lists of encodings between the Oniguruma library and mbfl, as a result of a pointer assignment error. Exploiting this vulnerability can allow an attacker to cause a service failure...

php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

A flaw was found in PHP. When an attacker input can influence the encoding passed to mbregexencoding and the application subsequently uses mbregex search APIs, a NULL pointer dereference can occur due to a mismatch between the Oniguruma and mbfl encoding support. This issue can cause a crash in t...

CVE-2026-7259

A flaw was found in PHP. When an attacker input can influence the encoding passed to mbregexencoding and the application subsequently uses mbregex search APIs, a NULL pointer dereference can occur due to a mismatch between the Oniguruma and mbfl encoding support. This issue can cause a crash in t...

Astra Linux – Vulnerability in libonig

Oniguruma, as used in PHP 7.3.x and other products, has a heap-based buffer over-read issue in the strlowercasematch function in regexec.c...

OESA-2026-2341 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

BIT-PHP-MIN-2026-7259 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when...

BIT-PHP-2026-7259 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when...

BIT-LIBPHP-2026-7259 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when...

PT-2026-40282

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when...