CVE-2017-9229

Name of the Vulnerable Software and Affected Versions Oniguruma version 6.2.0 Oniguruma-mod in Ruby versions through 2.4.1 mbstring in PHP versions through 7.1.5

Description An issue was discovered that causes a SIGSEGV in left adjust char head() during regular expression compilation. This occurs due to invalid handling of reg->dmax in forward search range(), which could result in an invalid pointer dereference. The issue normally leads to an immediate denial-of-service condition.

Recommendations For Oniguruma version 6.2.0, update to a version that fixes the issue in left adjust char head() and forward search range(). For Oniguruma-mod in Ruby versions through 2.4.1, update Ruby to a version that includes the fix for the Oniguruma issue. For mbstring in PHP versions through 7.1.5, update PHP to a version that includes the fix for the mbstring issue. As a temporary workaround, consider restricting the use of regular expressions in affected applications until a patch is available.