Critical Stack Out-of-Bounds Read in PHP5 Due to Oniguruma Vulnerability
Summary
ALPINE-CVE-2017-9227: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. Affects php5 versions < 5.6.31-r0. Fixed in 5.6.31-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP5 is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. However, certain versions of PHP5 are vulnerable to a critical issue stemming from the Oniguruma regular expression library, which can lead to severe security risks.
Vulnerability Detail
An issue was discovered in Oniguruma 6.2.0, which is utilized in PHP's mbstring extension. This vulnerability manifests as a stack out-of-bounds read in the mbc_enc_len() function during regular expression searching. The improper handling of the reg->dmin variable in the forward_search_range() function can lead to an invalid pointer dereference, resulting in an out-of-bounds read from a stack buffer. This vulnerability has a CVSS score of 9.8, indicating a critical risk that could allow attackers to exploit the system, potentially leading to unauthorized access or data leakage.
How To Fix
Minimum fixed version
5.6.31-r0
This is the first release that contains the fix.
sudo apk add --upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling the mbstring extension in your PHP configuration until you can apply the necessary updates. This can be done by commenting out the line 'extension=mbstring.so' in your php.ini file.
Conclusion
In summary, the vulnerability identified in PHP5 due to the Oniguruma library poses a significant risk to applications using affected versions. It is crucial to update to the patched version to mitigate potential threats. Utilizing tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for php5 →
FAQ
The vulnerability can lead to critical security issues, including unauthorized access and potential data leakage due to stack out-of-bounds reads.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The affected versions of PHP5 are those prior to 5.6.31-r0, specifically in Alpine Linux v3.4 and v3.5.
Yes, the permanent fix is to update to the patched version of PHP5, which is 5.6.31-r0 or later.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights into potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for php5.
