Your submission was sent successfully! Close

CVE-2017-9227

Published: 24 May 2017

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.

From the Ubuntu security team

It was discovered that Oniguruma incorrectly handled certain regular expressions. An attacker could possibly use this issue to obtain sensitive information, cause a denial of service or execute arbitrary code.

Priority

Medium

CVSS 3 base score: 9.8

Status

Package Release Status
libonig
Launchpad, Ubuntu, Debian
artful Ignored
(reached end-of-life)
bionic
Released (6.3.0-1)
precise Does not exist

trusty
Released (5.9.1-1ubuntu1.1)
upstream Needs triage

xenial
Released (5.9.6-1ubuntu0.1)
yakkety Ignored
(reached end-of-life)
zesty Ignored
(reached end-of-life)
php5
Launchpad, Ubuntu, Debian
artful Does not exist

bionic Does not exist

precise
Released (5.3.10-1ubuntu3.28)
trusty
Released (5.5.9+dfsg-1ubuntu4.22)
upstream Needs triage

xenial Does not exist

zesty Does not exist

php7.0
Launchpad, Ubuntu, Debian
artful Does not exist

bionic Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial
Released (7.0.22-0ubuntu0.16.04.1)
zesty
Released (7.0.22-0ubuntu0.17.04.1)
php7.1
Launchpad, Ubuntu, Debian
artful
Released (7.1.8-1ubuntu1)
bionic Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

zesty Does not exist