PT-2017-2623 · Ruby+5 · Ruby+5
Lxxxxfdho
·
Published
2017-05-22
·
Updated
2022-07-20
·
CVE-2017-9224
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Oniguruma version 6.2.0
Oniguruma-mod in Ruby versions prior to 2.4.1
mbstring in PHP versions prior to 7.1.5
Description
A logical error in the
match at() function of the Oniguruma library can result in a stack out-of-bounds read during regular expression searching. This issue is related to errors in access validation and could allow a remote attacker to impact information availability by reading beyond the stack buffer boundaries.Recommendations
For Oniguruma version 6.2.0, consider disabling the
match at() function until a patch is available.
For Oniguruma-mod in Ruby versions prior to 2.4.1, update to version 2.4.1 or later to resolve the issue.
For mbstring in PHP versions prior to 7.1.5, update to version 7.1.5 or later to resolve the issue.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Oniguruma
Php
Ruby
Suse
Ubuntu