Oniguruma CVE-2017-9227 Out of Bounds Read Memory Corruption Vulnerability

Bugtraq ID:	100538
Class:	Boundary Condition Error
CVE:	CVE-2017-9227
Remote:	Yes
Local:	No
Published:	May 23 2017 12:00AM
Updated:	Oct 11 2017 02:02PM
Credit:	lxxxxfdh
Vulnerable:	Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Redhat Enterprise Linux 5 Redhat Collections for Red Hat Enterprise Linux 0 PHP PHP 7.1.5 PHP PHP 7.1.4 PHP PHP 7.1.1 PHP PHP 7.1.3 PHP PHP 7.1.2 kkos oniguruma 6.2 IBM Flex System Manager 1.3.2 IBM Flex System Manager 1.3.4.0 IBM Flex System Manager 1.3.3.0 IBM Flex System Manager 1.3.2.1
Not Vulnerable:	PHP PHP 7.1.7 PHP PHP 5.6.31

Oniguruma CVE-2017-9227 Out of Bounds Read Memory Corruption Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Oniguruma CVE-2017-9227 Out of Bounds Read Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Oniguruma CVE-2017-9227 Out of Bounds Read Memory Corruption Vulnerability

References:

• Bug 1466739 - (CVE-2017-9227) CVE-2017-9227 oniguruma: Out-of-bounds stack read (Red Hat)
  
• Bug in mbc_enc_len #58 (kkos)
  
• CVE-2017-9227 (Red Hat)
  
• fix #58 : access to invalid address by reg->dmin value (kkos)
  
• PHP 5 ChangeLog (PHP)
  
• PHP 7 ChangeLog (PHP)
  
• isg3T1025810:Multiple vulnerabilities in php5 affect IBM Flex System Manager (FS (IBM)