CVE-2019-19012

An integer overflow vulnerability leading to an out-of-bounds read was found in the way Oniguruma handled regular expression quantifiers. A remote attacker could abuse this flaw by providing a malformed regular expression that, when processed by an application linked to Oniguruma, could crash the application, causing a denial of service.

This flaw only affected 32-bit compiled versions of Oniguruma. Therefore it did not affect the following 64-bit versions:

• PHP and Ruby as shipped with Red Hat Enterprise Linux 7.
• PHP and Ruby as shipped with Red Hat Software Collections 3.
• PHP as shipped with Red Hat Enterprise Linux 8.
• OpenShift containers: openshift4/ose-metering-hadoop, openshift4/ose-metering-hive, openshift4/ose-metering-presto.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.