CVE-2017-9225: Buffer Overflow

Published May 24, 2017
·
Updated

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigencunicodegetcasefoldcodesbystr() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicodeunfoldkey(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer of expandcasefoldstring() during the call to onigencunicodegetcasefoldcodesbystr(), a typical stack buffer overflow.

Affected Software

3 affected components
Oniguruma Project Oniguruma=6.2.0
PHP Php Oniguruma-mod<=7.1.5
ruby-lang Ruby Oniguruma-mod<=2.4.1

Event History

May 24, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description

Frequently Asked Questions

1

What is the severity of CVE-2017-9225?

CVE-2017-9225 has been assigned a medium severity rating due to the potential for stack out-of-bounds write vulnerabilities.

2

How do I fix CVE-2017-9225?

To fix CVE-2017-9225, update Oniguruma to version 6.2.1 or later, and update PHP and Ruby to versions that no longer include the affected Oniguruma-mod.

3

Which versions are affected by CVE-2017-9225?

CVE-2017-9225 affects Oniguruma version 6.2.0, Ruby up to version 2.4.1, and PHP up to version 7.1.5.

4

What kind of vulnerability is CVE-2017-9225?

CVE-2017-9225 is a stack out-of-bounds write vulnerability occurring during regular expression compilation.

5

Who is impacted by CVE-2017-9225?

Users of Oniguruma 6.2.0, Ruby versions up to 2.4.1, and PHP versions up to 7.1.5 are impacted by CVE-2017-9225.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203