MGASA-2020-0029 - Updated oniguruma packages fix security vulnerabilities

Publication date: 11 Jan 2020
URL: https://advisories.mageia.org/MGASA-2020-0029.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2019-13224,
     CVE-2019-13225,
     CVE-2019-16163,
     CVE-2019-19012,
     CVE-2019-19203,
     CVE-2019-19204,
     CVE-2019-19246

Updated oniguruma packages fix security vulnerabilities:

A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2
allows attackers to potentially cause information disclosure, denial
of service, or possibly code execution by providing a crafted regular
expression. The attacker provides a pair of a regex pattern and a string,
with a multi-byte encoding that gets handled by onig_new_deluxe()
(CVE-2019-13224).

A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2
allows attackers to potentially cause denial of service by providing a
crafted regular expression (CVE-2019-13225).

Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of
recursion in regparse.c (CVE-2019-16163).

An integer overflow in the search_in_range function in regexec.c leads to
an out-of-bounds read, in which the offset of this read is under the
control of an attacker. (This only affects the 32-bit compiled version).
Remote attackers can cause a denial-of-service or information disclosure,
or possibly have unspecified other impact, via a crafted regular expression
(CVE-2019-19012).

An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function
gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced
without checking if it passed the end of the matched string. This leads to
a heap-based buffer over-read (CVE-2019-19203).

In the function fetch_range_quantifier in regparse.c, PFETCH is called
without checking PEND. This leads to a heap-based buffer over-read and
lead to denial-of-service via a crafted regular expression
(CVE-2019-19204).

Heap-based buffer over-read in str_lower_case_match in regexec.c can lead
to denial-of-service via a crafted regular expression (CVE-2019-19246).

References:
- https://bugs.mageia.org/show_bug.cgi?id=25843
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SNL26OZSQRVLEO6JRNUVIMZTICXBNEQW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NWOWZZNFSAWM3BUTQNAE3PD44A6JU4KE/
- https://www.debian.org/lts/security/2019/dla-2020
- https://security-tracker.debian.org/tracker/CVE-2019-19203
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NO267PLHGYZSWX3XTRPKYBKD4J3YOU5V/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13224
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13225
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16163
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19012
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19203
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19204
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19246

SRPMS:
- 7/core/oniguruma-6.9.4-1.mga7