CVE-2017-9227

Critical

Published: 24/05/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, related to a stack out-of-bounds read. Invalid handling of reg->dmin in forward_search_range() could lead to an invalid pointer dereference.

Risk Assessment

This vulnerability may lead to unexpected application behavior, including potential data leakage or system crashes. It poses a threat to the integrity and availability of applications using these components.

Recommendation

It is recommended to update Oniguruma to the latest version and to monitor applications for potential exploits related to this vulnerability.

Original NVD description (English source)

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.