Out-of-bounds read in PHP - CVE-2017-9224
Published: July 6, 2017
Vulnerability identifier: #VU7345
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-9224
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The weakness exists in the mbstring due to stack out-of-bounds read in match_at() during regular expression searching. A remote attacker can trigger a logical error involving order of validation and access in match_at() and read arbitrary files on the system.
Successful exploitation of the vulnerability results in information disclosure.
The weakness exists in the mbstring due to stack out-of-bounds read in match_at() during regular expression searching. A remote attacker can trigger a logical error involving order of validation and access in match_at() and read arbitrary files on the system.
Successful exploitation of the vulnerability results in information disclosure.
Affected software
PHP
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Fedora
Red Hat Enterprise Linux for Power
Slackware Linux
php5 (Ubuntu package)
php5 (Alpine package)
php (Alpine package)
php7 (Alpine package)
jq
ruby20
php
oniguruma
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Fedora
Red Hat Enterprise Linux for Power
Slackware Linux
php5 (Ubuntu package)
php5 (Alpine package)
php (Alpine package)
php7 (Alpine package)
jq
ruby20
php
oniguruma
How to mitigate CVE-2017-9224
Update to version 7.0.21.
php5 (Ubuntu package) - update to 5.3.10-1ubuntu3.28
php5 (Alpine package) - addressed in versions 5.6.31-r0, 5.6.33-r0
php (Alpine package) - update to 5.6.31-r0
php7 (Alpine package) - update to 7.0.27-r0
jq - update to 1.6-2.el7
ruby20 - update to 2.0.0.648-2.42
php - addressed in versions 5.6.31-1.fc24, 7.0.21-1.fc25, 7.1.7-1.fc26
oniguruma - addressed in versions 5.9.6-4.fc24, 6.1.3-2.fc25, 6.1.3-3.fc25, 6.3.0-1.fc26, 6.8.2-1.el7
php5 (Alpine package) - addressed in versions 5.6.31-r0, 5.6.33-r0
php (Alpine package) - update to 5.6.31-r0
php7 (Alpine package) - update to 7.0.27-r0
jq - update to 1.6-2.el7
ruby20 - update to 2.0.0.648-2.42
php - addressed in versions 5.6.31-1.fc24, 7.0.21-1.fc25, 7.1.7-1.fc26
oniguruma - addressed in versions 5.9.6-4.fc24, 6.1.3-2.fc25, 6.1.3-3.fc25, 6.3.0-1.fc26, 6.8.2-1.el7
External References
Related Security Bulletins
- Multiple vulnerabilities in PHP
- Slackware Linux update for php
- Amazon Linux AMI update for php56
- Ubuntu update for PHP
- Amazon Linux AMI update for php70
- Red Hat update for php
- Out-of-bounds read in php5 (Alpine package)
- Out-of-bounds read in php7 (Alpine package)
- Out-of-bounds read in php (Alpine package)
- Amazon Linux AMI update for ruby20
- Fedora 26 update for oniguruma
- Fedora 25 update for oniguruma
- Fedora 24 update for oniguruma
- Fedora 25 update for php
- Fedora 24 update for php
- Fedora 26 update for php
- Fedora 25 update for oniguruma
- Fedora EPEL 7 update for jq, oniguruma