CVE-2017-9224
CriticalSummary
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, related to a stack out-of-bounds read. A logical error in match_at() during regular expression searching could lead to unauthorized reads from a stack buffer.
Risk Assessment
Organizations may be exposed to attacks that exploit this vulnerability to read sensitive data from memory, potentially leading to information disclosure or further attacks.
Recommendation
It is recommended to update Oniguruma to the latest version and monitor applications using Ruby and PHP for potential exploits.
Original NVD description (English source)
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.