Out-of-bounds write in Oniguruma - CVE-2020-26159

Vulnerability identifier: #VU47647

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-26159

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

In Oniguruma 6.9.5_rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one byte in concat_opt_exact_str in src/regcomp.c .

Oniguruma
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
Fedora
oniguruma (Alpine package)
oniguruma-debugsource
oniguruma-devel
libonig2
libonig2-debuginfo
libonig4
libonig4-debuginfo
oniguruma
IBM Cloud Transformation Advisor
Dell EMC VxRail Appliance

Install update from vendor's website.

oniguruma (Alpine package) - update to 6.9.5-r2
IBM Cloud Transformation Advisor - update to 3.10.1
oniguruma-debugsource - addressed in versions 5.9.2-13.6.1, 6.7.0-150000.3.3.1
oniguruma-devel - addressed in versions 5.9.2-13.6.1, 6.7.0-150000.3.3.1
libonig2 - update to 5.9.2-13.6.1
libonig2-debuginfo - update to 5.9.2-13.6.1
libonig4 - update to 6.7.0-150000.3.3.1
libonig4-debuginfo - update to 6.7.0-150000.3.3.1
oniguruma - addressed in versions 6.9.4-2.fc31, 6.9.5-3.rev1.fc32, 6.9.5-3.rev1.fc33
Dell EMC VxRail Appliance - addressed in versions 7.0.401, 8.0.000

• http://www.openwall.com/lists/oss-security/2020/09/30/7
• https://github.com/kkos/oniguruma/commit/cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0
• https://github.com/kkos/oniguruma/issues/207
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2ZCUPCKJNSUHQMXXZBRNDDGQQLBJ2ACT/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4NHVR7X5ZLXUGW3PBCPQMNFQ3OJCSMQD/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFUJY7BUIFBTZ3IUHVHCID4JYCRDGKPS/

• Out-of-bounds write in K.Kosako Oniguruma
• Out-of-bounds write in oniguruma (Alpine package)
• SUSE update for oniguruma
• Multiple vulnerabilities in Dell VxRail
• Multiple vulnerabilities in Dell VxRail Appliance components
• SUSE update for oniguruma
• Fedora 33 update for oniguruma
• Fedora 32 update for oniguruma
• Fedora 31 update for oniguruma
• Multiple vulnerabilities in IBM Cloud Transformation Advisor