PT-2017-2623 · Ruby+5 · Ruby+5
Lxxxxfdho
·
Publicado
2017-05-22
·
Atualizado
2022-07-20
·
CVE-2017-9224
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Oniguruma version 6.2.0
Oniguruma-mod in Ruby versions prior to 2.4.1
mbstring in PHP versions prior to 7.1.5
Description
A logical error in the
match at() function of the Oniguruma library can result in a stack out-of-bounds read during regular expression searching. This issue is related to errors in access validation and could allow a remote attacker to impact information availability by reading beyond the stack buffer boundaries.Recommendations
For Oniguruma version 6.2.0, consider disabling the
match at() function until a patch is available.
For Oniguruma-mod in Ruby versions prior to 2.4.1, update to version 2.4.1 or later to resolve the issue.
For mbstring in PHP versions prior to 7.1.5, update to version 7.1.5 or later to resolve the issue.Exploit
Correção
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Oniguruma
Php
Ruby
Suse
Ubuntu