An issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function fetchintervalquantifier (formerly known as fetchrange_quantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read.
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "libonig-dev": "5.9.1-1ubuntu1.1+esm2", "libonig-dev-dbgsym": "5.9.1-1ubuntu1.1+esm2", "libonig2-dbgsym": "5.9.1-1ubuntu1.1+esm2", "libonig2": "5.9.1-1ubuntu1.1+esm2", "libonig2-dbg": "5.9.1-1ubuntu1.1+esm2" } ] }
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "libonig-dev": "5.9.6-1ubuntu0.1+esm2", "libonig-dev-dbgsym": "5.9.6-1ubuntu0.1+esm2", "libonig2-dbgsym": "5.9.6-1ubuntu0.1+esm2", "libonig2": "5.9.6-1ubuntu0.1+esm2", "libonig2-dbg": "5.9.6-1ubuntu0.1+esm2" } ] }