CVE-2017-9228
CriticalSummary
An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, where a heap out-of-bounds write occurs in bitset_set_range() due to an uninitialized variable from an incorrect state transition. This can lead to memory corruption.
Risk Assessment
Organizations may face serious security issues, including the potential for arbitrary code execution or application instability, which could result in data loss or service downtime.
Recommendation
It is recommended to update Oniguruma to the latest version and to monitor applications using Ruby and PHP to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption.