CVE-2017-9229: Null Pointer Dereference

Q: What is the CVE ID of this vulnerability?

The CVE ID of this vulnerability is CVE-2017-9229.

Q: What is the severity of CVE-2017-9229?

The severity of CVE-2017-9229 is high.

Q: Which software is affected by CVE-2017-9229?

Oniguruma 6.2.0, Ruby through 2.4.1, and PHP through 7.1.5 are affected by CVE-2017-9229.

Q: How can I fix CVE-2017-9229?

To fix CVE-2017-9229, update Oniguruma to version 6.3.0 or later, or update Ruby to a version beyond 2.4.1. For PHP, update to version 7.1.7 or later.

Q: Where can I find more information about CVE-2017-9229?

You can find more information about CVE-2017-9229 on the following references: [Link 1](https://github.com/kkos/oniguruma/issues/59), [Link 2](https://github.com/kkos/oniguruma/commit/b690371bbf97794b4a1d3f295d4fb9a8b05d402d), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1466750).

Published May 23, 2017

Updated

Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)

Other sources

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod i ...

— Debian

Affected Software

22 affected componentsFixes available

redhat/rh-php70-php<0:7.0.27-1.el6

0:7.0.27-1.el6

redhat/rh-php70-php<0:7.0.27-1.el7

0:7.0.27-1.el7

redhat/oniguruma<6.3.0

6.3.0

redhat/php<5.6.31

5.6.31

redhat/php<7.0.21

7.0.21

redhat/php<7.1.7

7.1.7

PHP PHP<7.0.21

7.0.21

Oniguruma Project Oniguruma=6.2.0

PHP Php Oniguruma-mod<=7.1.5

ruby-lang Ruby Oniguruma-mod<=2.4.1

PHP PHP>=5.6.0<5.6.31

PHP PHP>=7.0.0<7.0.21

PHP PHP>=7.1.0<7.1.7

debian/libonig

6.9.6-1.16.9.8-16.9.9-1

alpine/php5<5.6.31-r0

5.6.31-r0

alpine/php5<5.6.31-r0

5.6.31-r0

alpine/php5<5.6.31-r0

5.6.31-r0

alpine/php5<5.6.31-r0

5.6.31-r0

alpine/php5<5.6.31-r0

5.6.31-r0

alpine/php7<7.0.21-r0

7.0.21-r0

alpine/php7<7.1.9-r0

7.1.9-r0

alpine/php7<7.1.7-r0

7.1.7-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/rh-php70-php to a version that resolves this vulnerability.
Fixed in 0:7.0.27-1.el6
Upgrade
Upgrade redhat/rh-php70-php to a version that resolves this vulnerability.
Fixed in 0:7.0.27-1.el7
Upgrade
Upgrade redhat/oniguruma to a version that resolves this vulnerability.
Fixed in 6.3.0
Upgrade
Upgrade redhat/php to a version that resolves this vulnerability.
Fixed in 5.6.31
Upgrade
Upgrade redhat/php to a version that resolves this vulnerability.
Fixed in 7.0.21
Upgrade
Upgrade redhat/php to a version that resolves this vulnerability.
Fixed in 7.1.7
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 7.0.21
Upgrade
Upgrade debian/libonig to a version that resolves this vulnerability.
Fixed in 6.9.6-1.1Fixed in 6.9.8-1Fixed in 6.9.9-1
Upgrade
Upgrade alpine/php5 to a version that resolves this vulnerability.
Fixed in 5.6.31-r0
Upgrade
Upgrade alpine/php7 to a version that resolves this vulnerability.
Fixed in 7.0.21-r0
Upgrade
Upgrade alpine/php7 to a version that resolves this vulnerability.
Fixed in 7.1.9-r0
Upgrade
Upgrade alpine/php7 to a version that resolves this vulnerability.
Fixed in 7.1.7-r0
Upgrade
Upgrade oniguruma to a version that resolves this vulnerability.
Patch b690371bbf97794b4a1d3f295d4fb9a8b05d402d

Event History

May 23, 2017

CVE Published

12:00 AM

May 24, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Data Sourced

via OSV·03:29 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

RHSA-2018:1296

Frequently Asked Questions

What is the CVE ID of this vulnerability?

The CVE ID of this vulnerability is CVE-2017-9229.

What is the severity of CVE-2017-9229?

The severity of CVE-2017-9229 is high.

Which software is affected by CVE-2017-9229?

Oniguruma 6.2.0, Ruby through 2.4.1, and PHP through 7.1.5 are affected by CVE-2017-9229.

How can I fix CVE-2017-9229?

To fix CVE-2017-9229, update Oniguruma to version 6.3.0 or later, or update Ruby to a version beyond 2.4.1. For PHP, update to version 7.1.7 or later.

Where can I find more information about CVE-2017-9229?

You can find more information about CVE-2017-9229 on the following references: [Link 1](https://github.com/kkos/oniguruma/issues/59), [Link 2](https://github.com/kkos/oniguruma/commit/b690371bbf97794b4a1d3f295d4fb9a8b05d402d), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1466750).

CVE-2017-9229: Null Pointer Dereference

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is the CVE ID of this vulnerability?

What is the severity of CVE-2017-9229?

Which software is affected by CVE-2017-9229?

How can I fix CVE-2017-9229?

Where can I find more information about CVE-2017-9229?

Company

Resources

Contact