CVE-2017-9225

🗓️ 24 May 2017 15:00:00Reported by mitreType

An issue discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. Stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer

Reporter	Title	Published	Views	Family All 29
ALT Linux	Security fix for the ALT Linux 8 package oniguruma version 6.4.0-alt1	12 Jul 201700:00	–	altlinux
Tenable Nessus	CentOS 9 : oniguruma-6.9.6-1.el9.5	29 Feb 202400:00	–	nessus
Tenable Nessus	Fedora 25 : oniguruma (2017-60997f0d14)	12 Jun 201700:00	–	nessus
Tenable Nessus	Fedora 26 : oniguruma (2017-ee01a2ced6)	17 Jul 201700:00	–	nessus
Tenable Nessus	Photon OS 1.0: Bindutils / Krb5 / Ruby / Sudo / Zlib PHSA-2017-0021 (deprecated)	17 Aug 201800:00	–	nessus
Tenable Nessus	Photon OS 1.0: Ruby PHSA-2017-0021	7 Feb 201900:00	–	nessus
CNVD	Oniguruma 'onigenc_unicode_get_case_fold_codes_by_str()' function stack buffer overflow vulnerability	26 May 201700:00	–	cnvd
Cvelist	CVE-2017-9225	24 May 201715:00	–	cvelist
Debian CVE	CVE-2017-9225	24 May 201715:00	–	debiancve
EUVD	EUVD-2017-18163	7 Oct 202500:30	–	euvd