CVE-2017-9229

High

Published: 24/05/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation, which could lead to an invalid pointer dereference.

Risk Assessment

This vulnerability may result in an immediate denial-of-service condition, affecting the availability of applications relying on these components.

Recommendation

It is recommended to update Oniguruma to the latest version and monitor applications for potential issues related to this vulnerability.

Other vulnerabilities in Oniguruma 6.2.0, Oniguruma-mod w Ruby do 2.4.1, mbstring w PHP do 7.1.5

CVE-2017-9227Critical
An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, related to a stack out-of-bounds read. Invalid handling of reg->dmin in forward_search_range() could lead to an invalid pointer dereference.

Original NVD description (English source)

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition.