Fluid Attacks Database

Description

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel5	php53	-	-
debian 14	libonig	>=0 <6.1.3-2	6.1.3-2
alpine v3.4	php5	>=0 <5.6.31-r0	5.6.31-r0
alpine v3.5	php5	>=0 <5.6.31-r0	5.6.31-r0
debian 13	libonig	>=0 <6.1.3-2	6.1.3-2
debian 12	libonig	>=0 <6.1.3-2	6.1.3-2
rpm rhel6	oniguruma	-	-
rpm rhel5	php	-	-
rpm rhel6	php	-	-
rpm rhel7	php	-	-

1-10 of 13

Aliases

1. CVE-2017-92272. NVD-2017-92273. OSV-2017-92274. OSV-DEBIAN-2017-92275. OSV-ALPINE-2017-92276. SECURITY-TRACKER-CVE-2017-92277. SECURITY-CVE-2017-9227

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.