CVE-2019-19246

Public on 2019-11-25

Modified on 2020-01-08

Description

Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.

Severity

Low

See what this means

CVSS v3 Base Score

4.8

See breakdown

Affected Packages

Platform	Package	Release Date	Advisory	Status
Amazon Linux 2 - Core	oniguruma	2020-01-06	ALAS2-2020-1380	Fixed

	Score Type	Score	Vector
Amazon Linux	CVSSv3	4.8	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L