An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade php5Upgrade php7 | Sep 20, 2017 | May 24, 2017 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade ruby-develUpgrade ruby-debuginfoUpgrade ruby-docUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-rakeUpgrade oniguruma-develUpgrade rubygem-minitestUpgrade oniguruma-debuginfoUpgrade rubygem-io-consoleUpgrade rubygemsUpgrade rubygems-develUpgrade onigurumaUpgrade ruby-tcltkUpgrade ruby-irb | Aug 9, 2023 | May 24, 2017 |
| Amazon_linux | — | Upgrade ruby20Upgrade php56Upgrade php70 | Aug 4, 2017 | May 24, 2017 |
| Debian | — | Upgrade libonig | May 28, 2017 | May 24, 2017 |
| Freebsd | — | Upgrade oniguruma4Upgrade php56-mbstringUpgrade php70-mbstringUpgrade oniguruma6Upgrade libevhtpUpgrade oniguruma5Upgrade php71-mbstring | Jul 7, 2017 | Jul 7, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade phpUpgrade php-pdoUpgrade php-ldapUpgrade php-soapUpgrade php-gdUpgrade php-processUpgrade php-recodeUpgrade php-odbcUpgrade php-mysqlUpgrade php-commonUpgrade php-xmlrpcUpgrade php-cliUpgrade php-xmlUpgrade php-pgsql | Dec 4, 2019 | May 24, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade php-recodeUpgrade phpUpgrade php-ldapUpgrade php-odbcUpgrade php-cliUpgrade php-xmlrpcUpgrade php-processUpgrade php-commonUpgrade php-pdoUpgrade php-gdUpgrade php-pgsqlUpgrade php-soapUpgrade php-mysqlUpgrade php-xml | Dec 18, 2019 | May 24, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Sep 24, 2019 | May 24, 2017 |
| Oracle Solaris | — | Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade library/oniguruma to version 6.1.1.1-11.4.2.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Oct 19, 2018 | May 24, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 22, 2017 |
| Suse | — | Upgrade php53-dbaUpgrade php53-sqliteUpgrade php53-mcryptUpgrade php53-shmopUpgrade php7-iconvUpgrade php5-opcacheUpgrade php5-bcmathUpgrade php7-pspellUpgrade php7-posixUpgrade php7-xmlrpcUpgrade php5-odbcUpgrade php53-pdoUpgrade php5-bz2Upgrade php7-mcryptUpgrade php53-readlineUpgrade php7-pcntlUpgrade php7-pearUpgrade php5-calendarUpgrade php7-imapUpgrade php5-xmlreaderUpgrade apache2-mod_php5Upgrade php53-zlibUpgrade php5-sqliteUpgrade php53-mysqlUpgrade php53-pgsqlUpgrade php53-bcmathUpgrade php5-pearUpgrade php5-xmlrpcUpgrade php53-pcntlUpgrade php5-gdUpgrade php53-gettextUpgrade php5-imapUpgrade php7-jsonUpgrade php7-mbstringUpgrade php7-ldapUpgrade php53-soapUpgrade php7-ftpUpgrade php7-sysvsemUpgrade php53-domUpgrade php5-ctypeUpgrade php53Upgrade php5-mbstringUpgrade php5-pgsqlUpgrade php53-wddxUpgrade php7-pgsqlUpgrade php5-socketsUpgrade php7-bz2Upgrade php7-domUpgrade php7-gettextUpgrade php53-ftpUpgrade php5-zipUpgrade php5-tokenizerUpgrade php53-fileinfoUpgrade php7-fastcgiUpgrade php5-xmlwriterUpgrade php7-snmpUpgrade php7-mysqlUpgrade php7-sqliteUpgrade php7-socketsUpgrade php7-odbcUpgrade php5-sysvshmUpgrade php7-ctypeUpgrade apache2-mod_php53Upgrade php7-pear-archive_tarUpgrade php53-curlUpgrade php5-wddxUpgrade php53-sysvmsgUpgrade php53-xmlwriterUpgrade php53-pspellUpgrade apache2-mod_php7Upgrade php53-ctypeUpgrade php7-pharUpgrade php53-exifUpgrade php7-shmopUpgrade php53-xmlreaderUpgrade php7-wddxUpgrade php7-develUpgrade php53-opensslUpgrade php5-sysvmsgUpgrade php5-domUpgrade php5-pspellUpgrade php5-fpmUpgrade php5-xslUpgrade php53-posixUpgrade php5-exifUpgrade php7-bcmathUpgrade php53-tokenizerUpgrade php7-dbaUpgrade php7-sysvmsgUpgrade php5-dbaUpgrade php53-xslUpgrade php7-calendarUpgrade php5-fileinfoUpgrade php53-develUpgrade php53-sysvsemUpgrade php7-tokenizerUpgrade php53-intlUpgrade php7-zlibUpgrade php7-enchantUpgrade php5-zlibUpgrade php5-enchantUpgrade php5-gettextUpgrade php53-xmlrpcUpgrade php5-iconvUpgrade php5-posixUpgrade php53-zipUpgrade php5-snmpUpgrade php7-opcacheUpgrade php53-snmpUpgrade php53-fastcgiUpgrade php53-ldapUpgrade php7-fileinfoUpgrade php5-ldapUpgrade php7-fpmUpgrade php7-zip | Jun 16, 2017 | May 24, 2017 |
| Ubuntu | — | Upgrade php5-cgiUpgrade php5Upgrade php5-cliUpgrade php7.0-fpmUpgrade php7.0-cliUpgrade php5-fpmUpgrade libapache2-mod-php5Upgrade php7.0-cgiUpgrade libapache2-mod-php7.0 | Aug 10, 2017 | May 24, 2017 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub