Stack Exhaustion Vulnerability in libonig
Summary
CVE-2019-16163: Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. Affects libonig across 2 version ranges.
< 6.9.4-1
< 4097828d7cc87589864fecf452f2cd46c5f37180
Fixed in 6.9.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libonig is an open-source library used for regular expression pattern matching. It is commonly used in various applications and programming languages. The library provides functions for compiling and executing regular expressions. However, a vulnerability has been discovered in versions before 6.9.3 that can lead to stack exhaustion.
Vulnerability Detail
The vulnerability, identified as CVE-2019-16163, originates from recursion in the regparse.c file of Oniguruma. This recursion can cause stack exhaustion in the regcomp.c file. An attacker can exploit this vulnerability to cause a denial-of-service (DoS) condition by providing a specially crafted regular expression pattern. The impact of this vulnerability can result in the affected application crashing or becoming unresponsive.
How To Fix
Minimum fixed version
6.9.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libonigTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the library to the fixed version.
Conclusion
The stack exhaustion vulnerability in libonig can be mitigated by updating the library to version 6.9.4-1 or later. It is crucial for developers to promptly apply the fix to ensure the security and stability of their applications. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for libonig →
FAQ
libonig is an open-source library used for regular expression pattern matching.
The vulnerability can lead to stack exhaustion, causing a denial-of-service condition in the affected application.
An attacker can exploit this vulnerability by providing a specially crafted regular expression pattern.
Yes, updating the libonig library to version 6.9.4-1 or later fixes this vulnerability.
No, updating the library to the fixed version is the only solution.
Related vulnerabilities
Recent vulnerabilities recorded for libonig.
