Advisories ยป MGASA-2020-0029

Updated oniguruma packages fix security vulnerabilities

Publication date: 11 Jan 2020
Modification date: 11 Jan 2020
Type: security
Affected Mageia releases : 7
CVE: CVE-2019-13224 , CVE-2019-13225 , CVE-2019-16163 , CVE-2019-19012 , CVE-2019-19203 , CVE-2019-19204 , CVE-2019-19246

Description

Updated oniguruma packages fix security vulnerabilities:

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2
allows attackers to potentially cause information disclosure, denial
of service, or possibly code execution by providing a crafted regular
expression. The attacker provides a pair of a regex pattern and a string,
with a multi-byte encoding that gets handled by onig_new_deluxe()
(CVE-2019-13224).

A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2
allows attackers to potentially cause denial of service by providing a
crafted regular expression (CVE-2019-13225).

Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of
recursion in regparse.c (CVE-2019-16163).

An integer overflow in the search_in_range function in regexec.c leads to
an out-of-bounds read, in which the offset of this read is under the
control of an attacker. (This only affects the 32-bit compiled version).
Remote attackers can cause a denial-of-service or information disclosure,
or possibly have unspecified other impact, via a crafted regular expression
(CVE-2019-19012).

An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function
gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced
without checking if it passed the end of the matched string. This leads to
a heap-based buffer over-read (CVE-2019-19203).

In the function fetch_range_quantifier in regparse.c, PFETCH is called
without checking PEND. This leads to a heap-based buffer over-read and
lead to denial-of-service via a crafted regular expression
(CVE-2019-19204).

Heap-based buffer over-read in str_lower_case_match in regexec.c can lead
to denial-of-service via a crafted regular expression (CVE-2019-19246).

References

SRPMS

7/core