CVE-2019-16162

An out-of-bounds read vulnerability was found in Onigmo in the way it handled wide characters in regular expressions. A remote attacker could exploit this flaw by providing a malformed regular expression that when processed by an application linked to Onigmo, would crash the application and cause a denial of service.

This flaw does not affect the versions of oniguruma as shipped with Red Hat Enterprise Linux 6, and 8 as they already include the patch. The same is true for the versions of oniguruma (embedded in php:7.2/php and php:7.3/php) as shipped with Red Hat Enterprise Linux 8, and the versions of oniguruma (embedded in rh-php72-php and rh-php73-php) as shipped with Red Hat Software Collections 3.

This flaw did not affect the versions of oniguruma (embedded in php) as shipped with Red Hat Enterprise Linux 6, and 7 as they did not include the vulnerable code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.