Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in strlowercase_match in regexec.c.
{ "vanir_signatures": [ { "deprecated": false, "id": "CVE-2019-19246-ee72ec58", "signature_version": "v1", "digest": { "line_hashes": [ "62515007490554007865331787131035268207", "73060259964332736538643090030886107933", "240203263475203359359784711152491354249", "158627744619430761962932360405786758087" ], "threshold": 0.9 }, "signature_type": "Line", "target": { "file": "src/regexec.c" }, "source": "https://github.com/kkos/oniguruma/commit/d3e402928b6eb3327f8f7d59a9edfa622fec557b" }, { "deprecated": false, "id": "CVE-2019-19246-f787398e", "signature_version": "v1", "digest": { "length": 390.0, "function_hash": "301772738909245608982934055287646460906" }, "signature_type": "Function", "target": { "function": "str_lower_case_match", "file": "src/regexec.c" }, "source": "https://github.com/kkos/oniguruma/commit/d3e402928b6eb3327f8f7d59a9edfa622fec557b" } ] }