Description
Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libonig | 6.9.4-1 | — |
| Debian 13 | libonig | 6.9.4-1 | — |
| Debian 12 | libonig | 6.9.4-1 | — |
| Debian 9 | libonig | 6.1.3-2+deb9u1 | DLA-2431-1 |
| Debian 8 | libonig | 5.9.5-3.2+deb8u4 | DLA-2020-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | libonig | 6.7.0-1ubuntu0.1~esm2 | USN-5662-1 |
| Ubuntu Pro 16.04 LTS | libonig | 5.9.6-1ubuntu0.1+esm2 | USN-5662-1 |
| Ubuntu Pro 14.04 LTS | libonig | 5.9.1-1ubuntu1.1+esm2 | USN-5662-1, USN-4460-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | apcu-panel +2 | 5.1.17-1.module+el8.1.0+3189+a1bff096 | RHSA-2020:3662 |
| RHEL 8 | libzip +2 | 1.5.2-1.module+el8.1.0+3189+a1bff096 | RHSA-2020:3662 |
| RHEL 8 | php +25 | 7.3.20-1.module+el8.2.0+7373+b272fdef | RHSA-2020:3662 |
| RHEL 8 | php-pear | 1:1.10.9-1.module+el8.1.0+3189+a1bff096 | RHSA-2020:3662 |
| RHEL 8 | php-pecl-rrd | 2.0.1-1.module+el8.2.0+4968+1d5097db | RHSA-2020:3662 |
| RHEL 8 | php-pecl-xdebug | 2.8.0-1.module+el8.2.0+4968+1d5097db | RHSA-2020:3662 |
| RHEL 8 | php-pecl-zip | 1.15.4-1.module+el8.1.0+3189+a1bff096 | RHSA-2020:3662 |
| RHEL 3 | rh-php73-php +27 | 7.3.20-1.el7 | RHSA-2020:5275 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | apcu-panel +2 | 5.1.17-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
| AlmaLinux 8 | libzip +2 | 1.5.2-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
| AlmaLinux 8 | php +25 | 7.3.20-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
| AlmaLinux 8 | php-pear | 1:1.10.9-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
| AlmaLinux 8 | php-pecl-rrd | 2.0.1-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
| AlmaLinux 8 | php-pecl-xdebug | 2.8.0-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
| AlmaLinux 8 | php-pecl-zip | 1.15.4-1.module_el8.3.0+2009+b272fdef | ALSA-2020:3662 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libzip | 1.5.2-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
| Rocky Linux 8 | php | 7.3.20-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
| Rocky Linux 8 | php-pear | 1:1.10.9-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
| Rocky Linux 8 | php-pecl-apcu | 5.1.17-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
| Rocky Linux 8 | php-pecl-rrd | 2.0.1-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
| Rocky Linux 8 | php-pecl-xdebug | 2.8.0-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
| Rocky Linux 8 | php-pecl-zip | 1.15.4-1.module+el8.4.0+414+2e7afcdd | RLSA-2020:3662 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| SLES 15 SP3 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| SLES 15 SP2 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| SLES 15 SP1 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP2 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| SLES for SAP 15 SP1 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| SLE Micro 5.2 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| SLE Micro 5.1 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| SLE HPC 15 SP2 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| SLE HPC 15 SP1 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| SUSE Manager Server 4.1 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| SUSE Manager Retail Branch Server 4.1 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| SUSE Manager Proxy 4.1 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| SUSE Enterprise Storage 7 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| SUSE Enterprise Storage 6 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | oniguruma | 6.9.7.1-1.2 | openSUSE-SU-2024:11111-1 |
| openSUSE Leap 15.4 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
| openSUSE Leap 15.3 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.2 | oniguruma | 6.7.0-150000.3.3.1 | SUSE-SU-2022:3327-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | oniguruma +1 | 5.9.6-1.amzn2.0.3 | ALAS2-2020-1380 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | apcu-panel +2 | 5.1.17-1.module+el8.2.0+5569+98c8b30d | ELSA-2020-3662 |
| Oracle Linux 8 | libzip +2 | 1.5.2-1.module+el8.2.0+5569+98c8b30d | ELSA-2020-3662 |
| Oracle Linux 8 | php +25 | 7.3.20-1.module+el8.2.0+7784+4033621d | ELSA-2020-3662 |
| Oracle Linux 8 | php-pear | 1:1.10.9-1.module+el8.2.0+5569+98c8b30d | ELSA-2020-3662 |
| Oracle Linux 8 | php-pecl-rrd | 2.0.1-1.module+el8.2.0+5569+98c8b30d | ELSA-2020-3662 |
| Oracle Linux 8 | php-pecl-xdebug | 2.8.0-1.module+el8.2.0+5569+98c8b30d | ELSA-2020-3662 |
| Oracle Linux 8 | php-pecl-zip | 1.15.4-1.module+el8.2.0+5569+98c8b30d | ELSA-2020-3662 |
Advisories 12
- ALSA-2020:3662 Moderate: php:7.3 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2020:3662 Red Hat Security Advisory: php:7.3 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 18, 2026
- RHSA-2020:5275 Red Hat Security Advisory: rh-php73-php security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 18, 2026
- USN-5662-1 libonig vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-4460-1 libonig vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-2020-1 libonig - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2431-1 libonig - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2020:3662 Moderate: php:7.3 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2022:3327-1 Security update for oniguruma SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11111-1 libonig5-6.9.7.1-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2020-3662 Moderate: php:7.3 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 9, 2020
- ALAS2-2020-1380 Moderate: oniguruma security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 8, 2020