Critical Memory Corruption Vulnerability in PHP5 due to Oniguruma Library Flaw
Summary
ALPINE-CVE-2017-9226: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. Affects php5 versions < 5.6.31-r0. Fixed in 5.6.31-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP5 is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. However, PHP5 has been found to be vulnerable to a critical memory corruption issue stemming from the Oniguruma regular expression library, which is utilized in various PHP functionalities, including mbstring. This vulnerability can lead to severe security risks if not addressed promptly.
Vulnerability Detail
An issue was discovered in Oniguruma 6.2.0, which is used in PHP5 through version 7.1.5. The vulnerability manifests as a heap out-of-bounds write or read during regular expression compilation. Specifically, octal numbers larger than 0xff are mishandled in the functions fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' can produce an invalid code point value, leading to out-of-bounds memory corruption. This vulnerability has a CVSS score of 9.8, indicating a critical severity level, and can potentially allow attackers to execute arbitrary code or crash the application.
How To Fix
Minimum fixed version
5.6.31-r0
This is the first release that contains the fix.
sudo apk add --upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using regular expressions that include octal numbers or validate input to ensure that such patterns are not processed until the package is updated. Implementing input sanitization can help mitigate the risk until a proper fix is applied.
Conclusion
The vulnerability identified in PHP5 due to the Oniguruma library poses a critical risk to applications utilizing this package. It is imperative to update to the patched version to mitigate potential exploitation. Regular monitoring and validation of dependencies can help maintain application security.
See every vulnerability recorded for php5 →
FAQ
The vulnerability is a memory corruption issue caused by improper handling of octal numbers in regular expressions, leading to potential exploitation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to arbitrary code execution, application crashes, or data corruption, posing significant security risks.
Yes, updating to PHP5 version 5.6.31-r0 or later will resolve the vulnerability.
If immediate updates are not possible, implement input validation to avoid processing potentially malicious regular expressions as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for php5.
