Heap-out-of-bounds write in PHP - CVE-2017-9226
Published: July 6, 2017
Vulnerability identifier: #VU7346
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-9226
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists in the mbstring due to heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. A remote attacker can supply a malformed regular expression containing an octal number in the form of '\700', trigger
out-of-bounds write memory corruption and execute arbitrary code with web server privileges.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists in the mbstring due to heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. A remote attacker can supply a malformed regular expression containing an octal number in the form of '\700', trigger
out-of-bounds write memory corruption and execute arbitrary code with web server privileges.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
PHP
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Fedora
Red Hat Enterprise Linux for Power
Slackware Linux
php5 (Ubuntu package)
php (Alpine package)
php5 (Alpine package)
php7 (Alpine package)
jq
php
oniguruma
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Fedora
Red Hat Enterprise Linux for Power
Slackware Linux
php5 (Ubuntu package)
php (Alpine package)
php5 (Alpine package)
php7 (Alpine package)
jq
php
oniguruma
How to mitigate CVE-2017-9226
Update to version 7.0.21.
php5 (Ubuntu package) - update to 5.3.10-1ubuntu3.28
php (Alpine package) - update to 5.6.31-r0
php5 (Alpine package) - addressed in versions 5.6.31-r0, 5.6.33-r0
php7 (Alpine package) - update to 7.0.27-r0
jq - update to 1.6-2.el7
php - addressed in versions 5.6.31-1.fc24, 7.0.21-1.fc25, 7.1.7-1.fc26
oniguruma - addressed in versions 5.9.6-4.fc24, 6.1.3-2.fc25, 6.1.3-3.fc25, 6.3.0-1.fc26, 6.8.2-1.el7
php (Alpine package) - update to 5.6.31-r0
php5 (Alpine package) - addressed in versions 5.6.31-r0, 5.6.33-r0
php7 (Alpine package) - update to 7.0.27-r0
jq - update to 1.6-2.el7
php - addressed in versions 5.6.31-1.fc24, 7.0.21-1.fc25, 7.1.7-1.fc26
oniguruma - addressed in versions 5.9.6-4.fc24, 6.1.3-2.fc25, 6.1.3-3.fc25, 6.3.0-1.fc26, 6.8.2-1.el7
External References
Related Security Bulletins
- Multiple vulnerabilities in PHP
- Slackware Linux update for php
- Amazon Linux AMI update for php56
- Ubuntu update for PHP
- Amazon Linux AMI update for php70
- Red Hat update for php
- Heap-out-of-bounds write in php5 (Alpine package)
- Heap-out-of-bounds write in php7 (Alpine package)
- Heap-out-of-bounds write in php (Alpine package)
- Fedora 26 update for oniguruma
- Fedora 25 update for oniguruma
- Fedora 24 update for oniguruma
- Fedora 25 update for php
- Fedora 24 update for php
- Fedora 26 update for php
- Fedora 25 update for oniguruma
- Fedora EPEL 7 update for jq, oniguruma