CVE-2017-9227

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbcenclen() during regular expression searching. Invalid handling of reg->dmin in forwardsearchrange() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.

References

Affected packages

Git / github.com/kkos/oniguruma

Affected ranges

Type: GIT
Repo: https://github.com/kkos/oniguruma
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

9690d3ab1f9bcd2db8cbe1fe3ee4a5da606b8814

Affected versions

v5.*

v5.9.6

v6.*

v6.0.0

v6.1.0

v6.1.1

v6.1.2

v6.1.3

Database specific

vanir_signatures

[
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2017-9227-87db20c4",
        "digest": {
            "length": 3055.0,
            "function_hash": "107256506076362528630293821856860722664"
        },
        "source": "https://github.com/kkos/oniguruma/commit/9690d3ab1f9bcd2db8cbe1fe3ee4a5da606b8814",
        "target": {
            "function": "forward_search_range",
            "file": "src/regexec.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2017-9227-ce1115bb",
        "digest": {
            "line_hashes": [
                "244917375269462939977115246385469839147",
                "260813193810532824259245784304712775384",
                "120231572746728307893137213880243448934",
                "118234623326047463135166462558158684412"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/kkos/oniguruma/commit/9690d3ab1f9bcd2db8cbe1fe3ee4a5da606b8814",
        "target": {
            "file": "src/regexec.c"
        }
    }
]

Git / github.com/php/php-src

Affected ranges

Type: GIT
Repo: https://github.com/php/php-src
Events: Introduced

fc1df8e7a6886e29a6ed5bef3f674ac61164e847

Fixed

de96a08a90e480f1afb655bcfeac8ac28a14228e