Critical Stack Out-of-Bounds Read Vulnerability in PHP5 - CVE-2017-9224
Summary
ALPINE-CVE-2017-9224: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. Affects php5 versions < 5.6.31-r0. Fixed in 5.6.31-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP5 is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. However, PHP5 has been found to be vulnerable to a critical issue stemming from the Oniguruma library, which is utilized for regular expression processing. This vulnerability can lead to severe security risks if not addressed promptly.
Vulnerability Detail
An issue was discovered in Oniguruma 6.2.0, which is used in PHP5. A stack out-of-bounds read occurs in the match_at() function during regular expression searching. This vulnerability arises from a logical error in the order of validation and access within match_at(), potentially allowing an attacker to read sensitive data from a stack buffer. The ramifications of this vulnerability are significant, as it could lead to unauthorized access to sensitive information, data corruption, or application crashes.
How To Fix
Minimum fixed version
5.6.31-r0
This is the first release that contains the fix.
sudo apk add --upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the use of regular expressions in your PHP applications until the update can be applied. This can be done by reviewing your code for any regex functions and replacing them with safer alternatives.
Conclusion
The CVE-2017-9224 vulnerability poses a significant risk to applications using PHP5 due to a critical stack out-of-bounds read issue. It is crucial to update to the patched version to mitigate potential security threats. Regular monitoring and prompt action are essential to maintain the security of your applications.
See every vulnerability recorded for php5 →
FAQ
CVE-2017-9224 is a critical vulnerability in PHP5 related to stack out-of-bounds reads caused by issues in the Oniguruma library.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity that requires immediate attention.
PHP5 versions prior to 5.6.31-r0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update PHP5 immediately, consider disabling the use of regular expressions in your applications as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for php5.
