CVE-2019-19012 Integer overflow in n/a
Remote attackers can cause denial of service or information disclosure via crafted regular expressions due to an integer overflow in the Oniguruma library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-19012?
CVE-2019-19012 is a critical vulnerability in Debian Debian Linux, published on 16 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.
Which versions are affected by CVE-2019-19012?
It affects 4 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Oniguruma Project Oniguruma, Redhat Enterprise Linux.
How do I fix CVE-2019-19012?
Upgrade to a fixed version.
Is CVE-2019-19012 being exploited?
There is no known exploitation of CVE-2019-19012 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2019-19012, GHSA-5mw9-mr3r-536c, UBUNTU-CVE-2019-19012.