<p>There is no fixed version for <code>Ubuntu:18.04</code> <code>libonig</code>.</p>

Use After Free Affecting libonig package, versions *

Threat Intelligence

1.42% (87^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-UBUNTU1804-LIBONIG-453256
published 24 Jul 2019
disclosed 10 Jul 2019

Report a new vulnerability Found a mistake?

Introduced: 10 Jul 2019

CVE-2019-13224 Open this link in a new tab CWE-416 Open this link in a new tab

How to fix?

There is no fixed version for Ubuntu:18.04 libonig.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libonig package and not the libonig package as distributed by Ubuntu. See How to fix? for Ubuntu:18.04 relevant fixed versions and status.

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

None
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

High
Integrity (I)

High
Availability (A)

High