CVE-2017-9224: Critical severity PHP PHP vulnerability
Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
Other sources
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in matchat() during regular expression searching. A logical error involving order of validation and access in matchat() could result in an out-of-bounds read from a stack buffer.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9224?
The severity of CVE-2017-9224 is critical with a score of 9.8.
What is the affected software for CVE-2017-9224?
The affected software for CVE-2017-9224 includes Oniguruma 6.2.0, Ruby through 2.4.1, and PHP through 7.1.5.
How can I fix CVE-2017-9224 in Oniguruma?
To fix CVE-2017-9224 in Oniguruma, update to version 6.3.0.
How can I fix CVE-2017-9224 in PHP?
To fix CVE-2017-9224 in PHP, update to version 7.0.21 or 7.1.7.
Where can I find more information about CVE-2017-9224?
You can find more information about CVE-2017-9224 at the following references: [Reference 1](https://github.com/kkos/oniguruma/issues/57), [Reference 2](https://github.com/kkos/oniguruma/commit/690313a061f7a4fa614ec5cc8368b4f2284e059b), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1466750).