CVE-2017-9224

Name of the Vulnerable Software and Affected Versions Oniguruma version 6.2.0 Oniguruma-mod in Ruby versions prior to 2.4.1 mbstring in PHP versions prior to 7.1.5

Description A logical error in the match at() function of the Oniguruma library can result in a stack out-of-bounds read during regular expression searching. This issue is related to errors in access validation and could allow a remote attacker to impact information availability by reading beyond the stack buffer boundaries.

Recommendations For Oniguruma version 6.2.0, consider disabling the match at() function until a patch is available. For Oniguruma-mod in Ruby versions prior to 2.4.1, update to version 2.4.1 or later to resolve the issue. For mbstring in PHP versions prior to 7.1.5, update to version 7.1.5 or later to resolve the issue.