Vulnerability Description
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oniguruma Project | Oniguruma | 6.2.0 |
| Php | Php | <= 7.1.5 |
| Ruby-Lang | Ruby | <= 2.4.1 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2018:1296Third Party Advisory
- https://github.com/kkos/oniguruma/commit/b690371bbf97794b4a1d3f295d4fb9a8b05d402PatchThird Party Advisory
- https://github.com/kkos/oniguruma/issues/59ExploitThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1296Third Party Advisory
- https://github.com/kkos/oniguruma/commit/b690371bbf97794b4a1d3f295d4fb9a8b05d402PatchThird Party Advisory
- https://github.com/kkos/oniguruma/issues/59ExploitThird Party Advisory
FAQ
What is CVE-2017-9229?
CVE-2017-9229 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression comp...
How severe is CVE-2017-9229?
CVE-2017-9229 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-9229?
Check the references section above for vendor advisories and patch information. Affected products include: Oniguruma Project Oniguruma, Php Php, Ruby-Lang Ruby.