1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
PublicDateAtUSN: 2017-05-24
Candidate: CVE-2017-9227
PublicDate: 2017-05-24
References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9227
http://www.ubuntu.com/usn/usn-3382-1
Description:
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in
Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds
read occurs in mbc_enc_len() during regular expression searching. Invalid
handling of reg->dmin in forward_search_range() could result in an invalid
pointer dereference, as an out-of-bounds read from a stack buffer.
Ubuntu-Description:
Notes:
Bugs:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863315
https://github.com/kkos/oniguruma/issues/58
Priority: medium
Discovered-by:
Assigned-to:
Patches_libonig:
upstream: https://github.com/kkos/oniguruma/commit/9690d3ab1f9bcd2db8cbe1fe3ee4a5da606b8814
upstream_libonig: needs-triage
precise/esm_libonig: DNE
trusty_libonig: needed
vivid/stable-phone-overlay_libonig: DNE
vivid/ubuntu-core_libonig: DNE
xenial_libonig: needed
yakkety_libonig: ignored (reached end-of-life)
zesty_libonig: needed
devel_libonig: needed
Patches_php5:
upstream: https://github.com/php/php-src/commit/bdf7393ddb15d0ac522250a9825b685437e2b966
upstream_php5: needs-triage
precise/esm_php5: needs-triage
trusty_php5: released (5.5.9+dfsg-1ubuntu4.22)
vivid/ubuntu-core_php5: DNE
xenial_php5: DNE
zesty_php5: DNE
devel_php5: DNE
Patches_php7.0:
upstream: https://github.com/php/php-src/commit/6a8ae7cf8db3ec8dabfd027e01cdbcbb52654c90
upstream_php7.0: needs-triage
precise/esm_php7.0: DNE
trusty_php7.0: DNE
vivid/ubuntu-core_php7.0: DNE
xenial_php7.0: released (7.0.22-0ubuntu0.16.04.1)
zesty_php7.0: released (7.0.22-0ubuntu0.17.04.1)
devel_php7.0: DNE
Patches_php7.1:
upstream: https://github.com/php/php-src/commit/6a8ae7cf8db3ec8dabfd027e01cdbcbb52654c90
upstream_php7.1: needs-triage
precise/esm_php7.1: DNE
trusty_php7.1: DNE
vivid/ubuntu-core_php7.1: DNE
xenial_php7.1: DNE
zesty_php7.1: DNE
devel_php7.1: released (7.1.8-1ubuntu1)
|