CVE-2017-9226
CriticalSummary
An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, where a heap out-of-bounds write or read occurs during regular expression compilation. Octal numbers larger than 0xff are not handled correctly, leading to memory corruption.
Risk Assessment
Organizations may be exposed to attacks exploiting this vulnerability, potentially leading to memory corruption and system takeover.
Recommendation
It is recommended to update Oniguruma to the latest version and monitor applications using Ruby and PHP to detect and block potential attacks.
Original NVD description (English source)
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.