Out-of-bounds read in PHP - CVE-2017-9227

Vulnerability identifier: #VU7347

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-9227

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger stack out-of-bounds read in mbc_enc_len() during regular expression searching and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

PHP
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Fedora
Red Hat Enterprise Linux for Power
Slackware Linux
php5 (Ubuntu package)
php (Alpine package)
php5 (Alpine package)
php7 (Alpine package)
jq
php
oniguruma

Update to version 7.0.21.

php5 (Ubuntu package) - update to 5.3.10-1ubuntu3.28
php (Alpine package) - update to 5.6.31-r0
php5 (Alpine package) - update to 5.6.31-r0
php7 (Alpine package) - update to 7.0.25-r0
jq - update to 1.6-2.el7
php - addressed in versions 5.6.31-1.fc24, 7.0.21-1.fc25, 7.1.7-1.fc26
oniguruma - addressed in versions 5.9.6-4.fc24, 6.1.3-2.fc25, 6.1.3-3.fc25, 6.3.0-1.fc26, 6.8.2-1.el7

• http://php.net/ChangeLog-7.php#7.0.21

• Multiple vulnerabilities in PHP
• Slackware Linux update for php
• Amazon Linux AMI update for php56
• Ubuntu update for PHP
• Amazon Linux AMI update for php70
• Red Hat update for php
• Out-of-bounds read in php5 (Alpine package)
• Out-of-bounds read in php7 (Alpine package)
• Out-of-bounds read in php (Alpine package)
• Fedora 26 update for oniguruma
• Fedora 25 update for oniguruma
• Fedora 24 update for oniguruma
• Fedora 25 update for php
• Fedora 24 update for php
• Fedora 26 update for php
• Fedora 25 update for oniguruma
• Fedora EPEL 7 update for jq, oniguruma