Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS-2017-871

Related Vulnerabilities: CVE-2017-9224   CVE-2017-9226   CVE-2017-9227   CVE-2017-9228   CVE-2017-9229  

Out-of-bounds heap write in bitset_set_range()An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption. (CVE-2017-9228) Invalid pointer dereference in left_adjust_char_head()An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition. (CVE-2017-9229) Heap buffer overflow in next_state_val() during regular expression compilationAn issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\\700'; would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption. (CVE-2017-9226) Out-of-bounds stack read in mbc_enc_len() during regular expression searchingAn issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg>dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer. CVE-2017-9227 Out-of-bounds stack read in match_at() during regular expression searchingAn issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer. (CVE-2017-9224)

Source

ALAS-2017-871

Amazon Linux AMI Security Advisory: ALAS-2017-871
Advisory Release Date: 2017-08-17 18:16 Pacific
Advisory Updated Date: 2017-08-17 22:43 Pacific
Severity: Medium
Issue Overview:

Out-of-bounds heap write in bitset_set_range()
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption. (CVE-2017-9228)

Invalid pointer dereference in left_adjust_char_head()
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition. (CVE-2017-9229)

Heap buffer overflow in next_state_val() during regular expression compilation
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\\700'; would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption. (CVE-2017-9226)

Out-of-bounds stack read in mbc_enc_len() during regular expression searching
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg>dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer. CVE-2017-9227

Out-of-bounds stack read in match_at() during regular expression searching
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer. (CVE-2017-9224)


Affected Packages:

php56


Issue Correction:
Run yum update php56 to update your system.

New Packages:
i686:
    php56-xmlrpc-5.6.31-1.134.amzn1.i686
    php56-recode-5.6.31-1.134.amzn1.i686
    php56-enchant-5.6.31-1.134.amzn1.i686
    php56-intl-5.6.31-1.134.amzn1.i686
    php56-odbc-5.6.31-1.134.amzn1.i686
    php56-bcmath-5.6.31-1.134.amzn1.i686
    php56-mcrypt-5.6.31-1.134.amzn1.i686
    php56-mssql-5.6.31-1.134.amzn1.i686
    php56-cli-5.6.31-1.134.amzn1.i686
    php56-mysqlnd-5.6.31-1.134.amzn1.i686
    php56-dbg-5.6.31-1.134.amzn1.i686
    php56-tidy-5.6.31-1.134.amzn1.i686
    php56-fpm-5.6.31-1.134.amzn1.i686
    php56-gd-5.6.31-1.134.amzn1.i686
    php56-process-5.6.31-1.134.amzn1.i686
    php56-pgsql-5.6.31-1.134.amzn1.i686
    php56-dba-5.6.31-1.134.amzn1.i686
    php56-pdo-5.6.31-1.134.amzn1.i686
    php56-pspell-5.6.31-1.134.amzn1.i686
    php56-common-5.6.31-1.134.amzn1.i686
    php56-gmp-5.6.31-1.134.amzn1.i686
    php56-ldap-5.6.31-1.134.amzn1.i686
    php56-5.6.31-1.134.amzn1.i686
    php56-mbstring-5.6.31-1.134.amzn1.i686
    php56-imap-5.6.31-1.134.amzn1.i686
    php56-opcache-5.6.31-1.134.amzn1.i686
    php56-soap-5.6.31-1.134.amzn1.i686
    php56-xml-5.6.31-1.134.amzn1.i686
    php56-embedded-5.6.31-1.134.amzn1.i686
    php56-snmp-5.6.31-1.134.amzn1.i686
    php56-devel-5.6.31-1.134.amzn1.i686
    php56-debuginfo-5.6.31-1.134.amzn1.i686

src:
    php56-5.6.31-1.134.amzn1.src

x86_64:
    php56-ldap-5.6.31-1.134.amzn1.x86_64
    php56-mcrypt-5.6.31-1.134.amzn1.x86_64
    php56-devel-5.6.31-1.134.amzn1.x86_64
    php56-gd-5.6.31-1.134.amzn1.x86_64
    php56-recode-5.6.31-1.134.amzn1.x86_64
    php56-pdo-5.6.31-1.134.amzn1.x86_64
    php56-tidy-5.6.31-1.134.amzn1.x86_64
    php56-intl-5.6.31-1.134.amzn1.x86_64
    php56-imap-5.6.31-1.134.amzn1.x86_64
    php56-fpm-5.6.31-1.134.amzn1.x86_64
    php56-soap-5.6.31-1.134.amzn1.x86_64
    php56-snmp-5.6.31-1.134.amzn1.x86_64
    php56-pgsql-5.6.31-1.134.amzn1.x86_64
    php56-xmlrpc-5.6.31-1.134.amzn1.x86_64
    php56-process-5.6.31-1.134.amzn1.x86_64
    php56-dbg-5.6.31-1.134.amzn1.x86_64
    php56-embedded-5.6.31-1.134.amzn1.x86_64
    php56-mssql-5.6.31-1.134.amzn1.x86_64
    php56-dba-5.6.31-1.134.amzn1.x86_64
    php56-debuginfo-5.6.31-1.134.amzn1.x86_64
    php56-5.6.31-1.134.amzn1.x86_64
    php56-mysqlnd-5.6.31-1.134.amzn1.x86_64
    php56-gmp-5.6.31-1.134.amzn1.x86_64
    php56-odbc-5.6.31-1.134.amzn1.x86_64
    php56-mbstring-5.6.31-1.134.amzn1.x86_64
    php56-bcmath-5.6.31-1.134.amzn1.x86_64
    php56-pspell-5.6.31-1.134.amzn1.x86_64
    php56-opcache-5.6.31-1.134.amzn1.x86_64
    php56-cli-5.6.31-1.134.amzn1.x86_64
    php56-common-5.6.31-1.134.amzn1.x86_64
    php56-enchant-5.6.31-1.134.amzn1.x86_64
    php56-xml-5.6.31-1.134.amzn1.x86_64

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started