CVE-2017-9225
CriticalSummary
An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, related to a stack out-of-bounds write during regular expression compilation. A malformed regular expression could lead to a stack buffer overflow.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code, potentially compromising system integrity or gaining unauthorized access.
Recommendation
It is recommended to update Oniguruma to the latest version and monitor applications using Ruby and PHP for potential attacks.
Original NVD description (English source)
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer of expand_case_fold_string() during the call to onigenc_unicode_get_case_fold_codes_by_str(), a typical stack buffer overflow.