#VU22932 Buffer Over-read in Oniguruma - CVE-2019-19203

Vulnerability identifier: #VU22932

Vulnerability risk: Medium

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2019-19203

CWE-ID: CWE-126

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Oniguruma
Universal components / Libraries / Libraries used by multiple products

Vendor: K.Kosako

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in the "gb18030_mbc_enc_len" function in "gb18030.c" file due to the UChar pointer is dereferenced without checking if it passed the end of the matched string. A remote attacker can cause a denial of service condition on the target system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Oniguruma: 6.0.0 - 6.9.4 rc1

---

External links
https://github.com/kkos/oniguruma/issues/163
https://github.com/kkos/oniguruma/releases/tag/v6.9.4_rc2

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.