Skip to content
OpenAdvisories
Medium ALSA-2024:0889 5 CVEs

Moderate: oniguruma security update

Published Feb 20, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Oniguruma is a regular expressions library that supports a variety of character encodings.

Security Fix(es):

* oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)
* oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)
* oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read (CVE-2019-19012)
* oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c (CVE-2019-19203)
* oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c (CVE-2019-19204)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 8 oniguruma 6.8.2-2.1.el8_9
AlmaLinux · 8 oniguruma-devel 6.8.2-2.1.el8_9

Vulnerabilities 5

References

  • report
    https://access.redhat.com/security/cve/CVE-2019-13224
  • report
    https://access.redhat.com/security/cve/CVE-2019-16163
  • report
    https://access.redhat.com/security/cve/CVE-2019-19012
  • report
    https://access.redhat.com/security/cve/CVE-2019-19203
  • report
    https://access.redhat.com/security/cve/CVE-2019-19204
  • report
    https://bugzilla.redhat.com/1728970
  • report
    https://bugzilla.redhat.com/1768997
  • report
    https://bugzilla.redhat.com/1802051
  • report
    https://bugzilla.redhat.com/1802061
  • report
    https://bugzilla.redhat.com/1802068
  • advisory
    https://errata.almalinux.org/8/ALSA-2024-0889.html