Stack Out-of-Bounds Read in Oniguruma-mod and mbstring
Summary
CVE-2017-9227: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. Affects php5 across 3 version ranges.
< 5.6.31-r0
< 9690d3ab1f9bcd2db8cbe1fe3ee4a5da606b8814
>= fc1df8e7a6886e29a6ed5bef3f674ac61164e847, < de96a08a90e480f1afb655bcfeac8ac28a14228e
Fixed in 5.6.31-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Oniguruma is a regular expression library that is used in various programming languages, including Ruby and PHP. It provides support for pattern matching and searching within strings. Oniguruma-mod is a modified version of Oniguruma used in Ruby, while mbstring is a PHP extension that handles multibyte character encodings. This vulnerability affects Oniguruma 6.2.0, Oniguruma-mod in Ruby through 2.4.1, and mbstring in PHP through 7.1.5.
Vulnerability Detail
The vulnerability, identified as CVE-2017-9227, is a stack out-of-bounds read that occurs during regular expression searching. It is caused by invalid handling of reg->dmin in forward_search_range(), which can result in an invalid pointer dereference and an out-of-bounds read from a stack buffer. This vulnerability can be exploited by an attacker to read sensitive information from the stack memory, potentially leading to information disclosure or remote code execution.
How To Fix
Minimum fixed version
5.6.31-r0
This is the first release that contains the fix.
sudo apk add --upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The stack out-of-bounds read vulnerability in Oniguruma-mod and mbstring can lead to information disclosure or remote code execution. It is crucial to update the affected packages to the fixed versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
Oniguruma is a regular expression library used in various programming languages for pattern matching and searching within strings.
This vulnerability affects Oniguruma-mod in Ruby through version 2.4.1.
This vulnerability affects mbstring in PHP through version 7.1.5.
This vulnerability can be exploited by an attacker to read sensitive information from the stack memory, potentially leading to information disclosure or remote code execution.
To fix this vulnerability, update your PHP installation to version 5.6.31-r0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
