CVE-2017-9225 Memory corruption in n/a
A stack buffer overflow in the Oniguruma regex library allows attackers to execute arbitrary code or cause denial of service via a malformed regular expression.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-9225?
CVE-2017-9225 is a critical memory corruption vulnerability in Php Php, published on 24 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer of expand_case_fold_string() during the call to onigenc_unicode_get_case_fold_codes_by_str(), a typical stack buffer overflow.
Weakness: CWE-787
Which versions are affected by CVE-2017-9225?
It affects 3 products.
Products include Oniguruma Project Oniguruma, Php Php, Ruby-Lang Ruby.
How do I fix CVE-2017-9225?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-9225 being exploited?
There is no known exploitation of CVE-2017-9225 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as DEBIAN-CVE-2017-9225, GHSA-24pf-h82m-5vvv.