CVE-2017-9225

Name	CVE-2017-9225
Description	An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer of expand_case_fold_string() during the call to onigenc_unicode_get_case_fold_codes_by_str(), a typical stack buffer overflow.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	863313

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libonig (PTS)	bullseye	6.9.6-1.1	fixed
	bookworm	6.9.8-1	fixed
	sid, trixie	6.9.9-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
libonig	source	wheezy	(not affected)
libonig	source	jessie	(not affected)
libonig	source	(unstable)	6.1.3-2	863313

Notes

[jessie] - libonig <not-affected> (Vulnerable code introduced later)
[wheezy] - libonig <not-affected> (Vulnerable code introduced later)
https://github.com/kkos/oniguruma/commit/166a6c3999bf06b4de0ab4ce6b088a468cc4029f
https://github.com/kkos/oniguruma/issues/56