CVE-2017-9226: Critical severity PHP PHP vulnerability
Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
Other sources
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in nextstateval() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetchtoken() and fetchtokenincc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in nextstateval(), resulting in an out-of-bounds write memory corruption. Upstream bug:
https://github.com/kkos/oniguruma/issues/55
Upstream patch:
https://github.com/kkos/oniguruma/commit/f015fbdd95f76438cd86366467bb2b39870dd7c6
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2017-9226?
CVE-2017-9226 is a vulnerability in Oniguruma, as used in Oniguruma-mod in Ruby and mbstring in PHP, that allows a heap out-of-bounds write or read during regular expression compilation.
Which software is affected by CVE-2017-9226?
CVE-2017-9226 affects Oniguruma-mod in Ruby versions up to 2.4.1 and mbstring in PHP versions up to 7.1.5.
What is the severity of CVE-2017-9226?
CVE-2017-9226 has a severity rating of 9.8, which is considered critical.
How do I fix CVE-2017-9226 in Oniguruma?
To fix CVE-2017-9226 in Oniguruma, you should upgrade to version 6.3.0 or higher.
How do I fix CVE-2017-9226 in PHP?
To fix CVE-2017-9226 in PHP, you should upgrade to version 7.0.21 or higher for PHP 7.0, and version 7.1.7 or higher for PHP 7.1.