Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS-2017-867

Related Vulnerabilities: CVE-2017-7890   CVE-2017-9224   CVE-2017-9226   CVE-2017-9227   CVE-2017-9228   CVE-2017-9229  

Out-of-bounds heap write in bitset_set_range():An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption. (CVE-2017-9228) Buffer over-read from unitialized data in gdImageCreateFromGifCtx functionThe GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information. (CVE-2017-7890) Invalid pointer dereference in left_adjust_char_head():An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition. (CVE-2017-9229) Heap buffer overflow in next_state_val() during regular expression compilation:An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of \\700 would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.(CVE-2017-9226) Out-of-bounds stack read in mbc_enc_len() during regular expression searching:An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer. (CVE-2017-9227) Out-of-bounds stack read in match_at() during regular expression searching:An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer. (CVE-2017-9224)

Source

ALAS-2017-867

Amazon Linux AMI Security Advisory: ALAS-2017-867
Advisory Release Date: 2017-08-03 20:38 Pacific
Advisory Updated Date: 2017-08-04 02:34 Pacific
Severity: Medium
Issue Overview:

Out-of-bounds heap write in bitset_set_range():
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption. (CVE-2017-9228)

Buffer over-read from unitialized data in gdImageCreateFromGifCtx function
The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information. (CVE-2017-7890)

Invalid pointer dereference in left_adjust_char_head():
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition. (CVE-2017-9229)

Heap buffer overflow in next_state_val() during regular expression compilation:
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of \\700 would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.(CVE-2017-9226)

Out-of-bounds stack read in mbc_enc_len() during regular expression searching:
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer. (CVE-2017-9227)

Out-of-bounds stack read in match_at() during regular expression searching:
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer. (CVE-2017-9224)


Affected Packages:

php70


Issue Correction:
Run yum update php70 to update your system.

New Packages:
i686:
    php70-imap-7.0.21-1.23.amzn1.i686
    php70-gd-7.0.21-1.23.amzn1.i686
    php70-fpm-7.0.21-1.23.amzn1.i686
    php70-7.0.21-1.23.amzn1.i686
    php70-pdo-dblib-7.0.21-1.23.amzn1.i686
    php70-debuginfo-7.0.21-1.23.amzn1.i686
    php70-common-7.0.21-1.23.amzn1.i686
    php70-gmp-7.0.21-1.23.amzn1.i686
    php70-ldap-7.0.21-1.23.amzn1.i686
    php70-odbc-7.0.21-1.23.amzn1.i686
    php70-devel-7.0.21-1.23.amzn1.i686
    php70-enchant-7.0.21-1.23.amzn1.i686
    php70-snmp-7.0.21-1.23.amzn1.i686
    php70-json-7.0.21-1.23.amzn1.i686
    php70-mcrypt-7.0.21-1.23.amzn1.i686
    php70-process-7.0.21-1.23.amzn1.i686
    php70-intl-7.0.21-1.23.amzn1.i686
    php70-soap-7.0.21-1.23.amzn1.i686
    php70-mysqlnd-7.0.21-1.23.amzn1.i686
    php70-dbg-7.0.21-1.23.amzn1.i686
    php70-dba-7.0.21-1.23.amzn1.i686
    php70-pgsql-7.0.21-1.23.amzn1.i686
    php70-recode-7.0.21-1.23.amzn1.i686
    php70-pdo-7.0.21-1.23.amzn1.i686
    php70-zip-7.0.21-1.23.amzn1.i686
    php70-embedded-7.0.21-1.23.amzn1.i686
    php70-mbstring-7.0.21-1.23.amzn1.i686
    php70-pspell-7.0.21-1.23.amzn1.i686
    php70-opcache-7.0.21-1.23.amzn1.i686
    php70-xmlrpc-7.0.21-1.23.amzn1.i686
    php70-bcmath-7.0.21-1.23.amzn1.i686
    php70-tidy-7.0.21-1.23.amzn1.i686
    php70-xml-7.0.21-1.23.amzn1.i686
    php70-cli-7.0.21-1.23.amzn1.i686

src:
    php70-7.0.21-1.23.amzn1.src

x86_64:
    php70-mysqlnd-7.0.21-1.23.amzn1.x86_64
    php70-xml-7.0.21-1.23.amzn1.x86_64
    php70-cli-7.0.21-1.23.amzn1.x86_64
    php70-pspell-7.0.21-1.23.amzn1.x86_64
    php70-fpm-7.0.21-1.23.amzn1.x86_64
    php70-embedded-7.0.21-1.23.amzn1.x86_64
    php70-intl-7.0.21-1.23.amzn1.x86_64
    php70-recode-7.0.21-1.23.amzn1.x86_64
    php70-common-7.0.21-1.23.amzn1.x86_64
    php70-pgsql-7.0.21-1.23.amzn1.x86_64
    php70-odbc-7.0.21-1.23.amzn1.x86_64
    php70-mbstring-7.0.21-1.23.amzn1.x86_64
    php70-dbg-7.0.21-1.23.amzn1.x86_64
    php70-pdo-7.0.21-1.23.amzn1.x86_64
    php70-devel-7.0.21-1.23.amzn1.x86_64
    php70-enchant-7.0.21-1.23.amzn1.x86_64
    php70-snmp-7.0.21-1.23.amzn1.x86_64
    php70-process-7.0.21-1.23.amzn1.x86_64
    php70-debuginfo-7.0.21-1.23.amzn1.x86_64
    php70-imap-7.0.21-1.23.amzn1.x86_64
    php70-zip-7.0.21-1.23.amzn1.x86_64
    php70-ldap-7.0.21-1.23.amzn1.x86_64
    php70-json-7.0.21-1.23.amzn1.x86_64
    php70-xmlrpc-7.0.21-1.23.amzn1.x86_64
    php70-tidy-7.0.21-1.23.amzn1.x86_64
    php70-opcache-7.0.21-1.23.amzn1.x86_64
    php70-bcmath-7.0.21-1.23.amzn1.x86_64
    php70-dba-7.0.21-1.23.amzn1.x86_64
    php70-soap-7.0.21-1.23.amzn1.x86_64
    php70-mcrypt-7.0.21-1.23.amzn1.x86_64
    php70-7.0.21-1.23.amzn1.x86_64
    php70-gd-7.0.21-1.23.amzn1.x86_64
    php70-pdo-dblib-7.0.21-1.23.amzn1.x86_64
    php70-gmp-7.0.21-1.23.amzn1.x86_64

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started