Amazon Linux AMI update for php70



Published: 2017-08-03
Risk High
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2017-9228
CVE-2017-7890
CVE-2017-9229
CVE-2017-9226
CVE-2017-9227
CVE-2017-9224
CWE-ID CWE-787
CWE-200
CWE-476
CWE-125
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Amazon Linux AMI
Operating systems & Components / Operating system

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Heap-out-of-bounds write

EUVDB-ID: #VU7348

Risk: High

CVSSv3.1:

CVE-ID: CVE-2017-9228

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists in the mbstring due to heap out-of-bounds write in bitset_set_range() during regular expression compilation due to incorrect state transition in parse_char_class(). A remote attacker can trigger out-of-bounds write memory corruption and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected packages.

i686:
    php70-imap-7.0.21-1.23.amzn1.i686
    php70-gd-7.0.21-1.23.amzn1.i686
    php70-fpm-7.0.21-1.23.amzn1.i686
    php70-7.0.21-1.23.amzn1.i686
    php70-pdo-dblib-7.0.21-1.23.amzn1.i686
    php70-debuginfo-7.0.21-1.23.amzn1.i686
    php70-common-7.0.21-1.23.amzn1.i686
    php70-gmp-7.0.21-1.23.amzn1.i686
    php70-ldap-7.0.21-1.23.amzn1.i686
    php70-odbc-7.0.21-1.23.amzn1.i686
    php70-devel-7.0.21-1.23.amzn1.i686
    php70-enchant-7.0.21-1.23.amzn1.i686
    php70-snmp-7.0.21-1.23.amzn1.i686
    php70-json-7.0.21-1.23.amzn1.i686
    php70-mcrypt-7.0.21-1.23.amzn1.i686
    php70-process-7.0.21-1.23.amzn1.i686
    php70-intl-7.0.21-1.23.amzn1.i686
    php70-soap-7.0.21-1.23.amzn1.i686
    php70-mysqlnd-7.0.21-1.23.amzn1.i686
    php70-dbg-7.0.21-1.23.amzn1.i686
    php70-dba-7.0.21-1.23.amzn1.i686
    php70-pgsql-7.0.21-1.23.amzn1.i686
    php70-recode-7.0.21-1.23.amzn1.i686
    php70-pdo-7.0.21-1.23.amzn1.i686
    php70-zip-7.0.21-1.23.amzn1.i686
    php70-embedded-7.0.21-1.23.amzn1.i686
    php70-mbstring-7.0.21-1.23.amzn1.i686
    php70-pspell-7.0.21-1.23.amzn1.i686
    php70-opcache-7.0.21-1.23.amzn1.i686
    php70-xmlrpc-7.0.21-1.23.amzn1.i686
    php70-bcmath-7.0.21-1.23.amzn1.i686
    php70-tidy-7.0.21-1.23.amzn1.i686
    php70-xml-7.0.21-1.23.amzn1.i686
    php70-cli-7.0.21-1.23.amzn1.i686

src:
    php70-7.0.21-1.23.amzn1.src

x86_64:
    php70-mysqlnd-7.0.21-1.23.amzn1.x86_64
    php70-xml-7.0.21-1.23.amzn1.x86_64
    php70-cli-7.0.21-1.23.amzn1.x86_64
    php70-pspell-7.0.21-1.23.amzn1.x86_64
    php70-fpm-7.0.21-1.23.amzn1.x86_64
    php70-embedded-7.0.21-1.23.amzn1.x86_64
    php70-intl-7.0.21-1.23.amzn1.x86_64
    php70-recode-7.0.21-1.23.amzn1.x86_64
    php70-common-7.0.21-1.23.amzn1.x86_64
    php70-pgsql-7.0.21-1.23.amzn1.x86_64
    php70-odbc-7.0.21-1.23.amzn1.x86_64
    php70-mbstring-7.0.21-1.23.amzn1.x86_64
    php70-dbg-7.0.21-1.23.amzn1.x86_64
    php70-pdo-7.0.21-1.23.amzn1.x86_64
    php70-devel-7.0.21-1.23.amzn1.x86_64
    php70-enchant-7.0.21-1.23.amzn1.x86_64
    php70-snmp-7.0.21-1.23.amzn1.x86_64
    php70-process-7.0.21-1.23.amzn1.x86_64
    php70-debuginfo-7.0.21-1.23.amzn1.x86_64
    php70-imap-7.0.21-1.23.amzn1.x86_64
    php70-zip-7.0.21-1.23.amzn1.x86_64
    php70-ldap-7.0.21-1.23.amzn1.x86_64
    php70-json-7.0.21-1.23.amzn1.x86_64
    php70-xmlrpc-7.0.21-1.23.amzn1.x86_64
    php70-tidy-7.0.21-1.23.amzn1.x86_64
    php70-opcache-7.0.21-1.23.amzn1.x86_64
    php70-bcmath-7.0.21-1.23.amzn1.x86_64
    php70-dba-7.0.21-1.23.amzn1.x86_64
    php70-soap-7.0.21-1.23.amzn1.x86_64
    php70-mcrypt-7.0.21-1.23.amzn1.x86_64
    php70-7.0.21-1.23.amzn1.x86_64
    php70-gd-7.0.21-1.23.amzn1.x86_64
    php70-pdo-dblib-7.0.21-1.23.amzn1.x86_64
    php70-gmp-7.0.21-1.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions


CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2017-867.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Information disclosure

EUVDB-ID: #VU11789

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2017-7890

CWE-ID: CWE-200 - Information Exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c due to it does not zero colorMap arrays before use. A remote attacker can trick the victim into opening a specially crafted GIF image that could use the uninitialized tables to read ~700 bytes from the top of the stack and gain access to potentially sensitive information.

Mitigation

Update the affected packages.

i686:
    php70-imap-7.0.21-1.23.amzn1.i686
    php70-gd-7.0.21-1.23.amzn1.i686
    php70-fpm-7.0.21-1.23.amzn1.i686
    php70-7.0.21-1.23.amzn1.i686
    php70-pdo-dblib-7.0.21-1.23.amzn1.i686
    php70-debuginfo-7.0.21-1.23.amzn1.i686
    php70-common-7.0.21-1.23.amzn1.i686
    php70-gmp-7.0.21-1.23.amzn1.i686
    php70-ldap-7.0.21-1.23.amzn1.i686
    php70-odbc-7.0.21-1.23.amzn1.i686
    php70-devel-7.0.21-1.23.amzn1.i686
    php70-enchant-7.0.21-1.23.amzn1.i686
    php70-snmp-7.0.21-1.23.amzn1.i686
    php70-json-7.0.21-1.23.amzn1.i686
    php70-mcrypt-7.0.21-1.23.amzn1.i686
    php70-process-7.0.21-1.23.amzn1.i686
    php70-intl-7.0.21-1.23.amzn1.i686
    php70-soap-7.0.21-1.23.amzn1.i686
    php70-mysqlnd-7.0.21-1.23.amzn1.i686
    php70-dbg-7.0.21-1.23.amzn1.i686
    php70-dba-7.0.21-1.23.amzn1.i686
    php70-pgsql-7.0.21-1.23.amzn1.i686
    php70-recode-7.0.21-1.23.amzn1.i686
    php70-pdo-7.0.21-1.23.amzn1.i686
    php70-zip-7.0.21-1.23.amzn1.i686
    php70-embedded-7.0.21-1.23.amzn1.i686
    php70-mbstring-7.0.21-1.23.amzn1.i686
    php70-pspell-7.0.21-1.23.amzn1.i686
    php70-opcache-7.0.21-1.23.amzn1.i686
    php70-xmlrpc-7.0.21-1.23.amzn1.i686
    php70-bcmath-7.0.21-1.23.amzn1.i686
    php70-tidy-7.0.21-1.23.amzn1.i686
    php70-xml-7.0.21-1.23.amzn1.i686
    php70-cli-7.0.21-1.23.amzn1.i686

src:
    php70-7.0.21-1.23.amzn1.src

x86_64:
    php70-mysqlnd-7.0.21-1.23.amzn1.x86_64
    php70-xml-7.0.21-1.23.amzn1.x86_64
    php70-cli-7.0.21-1.23.amzn1.x86_64
    php70-pspell-7.0.21-1.23.amzn1.x86_64
    php70-fpm-7.0.21-1.23.amzn1.x86_64
    php70-embedded-7.0.21-1.23.amzn1.x86_64
    php70-intl-7.0.21-1.23.amzn1.x86_64
    php70-recode-7.0.21-1.23.amzn1.x86_64
    php70-common-7.0.21-1.23.amzn1.x86_64
    php70-pgsql-7.0.21-1.23.amzn1.x86_64
    php70-odbc-7.0.21-1.23.amzn1.x86_64
    php70-mbstring-7.0.21-1.23.amzn1.x86_64
    php70-dbg-7.0.21-1.23.amzn1.x86_64
    php70-pdo-7.0.21-1.23.amzn1.x86_64
    php70-devel-7.0.21-1.23.amzn1.x86_64
    php70-enchant-7.0.21-1.23.amzn1.x86_64
    php70-snmp-7.0.21-1.23.amzn1.x86_64
    php70-process-7.0.21-1.23.amzn1.x86_64
    php70-debuginfo-7.0.21-1.23.amzn1.x86_64
    php70-imap-7.0.21-1.23.amzn1.x86_64
    php70-zip-7.0.21-1.23.amzn1.x86_64
    php70-ldap-7.0.21-1.23.amzn1.x86_64
    php70-json-7.0.21-1.23.amzn1.x86_64
    php70-xmlrpc-7.0.21-1.23.amzn1.x86_64
    php70-tidy-7.0.21-1.23.amzn1.x86_64
    php70-opcache-7.0.21-1.23.amzn1.x86_64
    php70-bcmath-7.0.21-1.23.amzn1.x86_64
    php70-dba-7.0.21-1.23.amzn1.x86_64
    php70-soap-7.0.21-1.23.amzn1.x86_64
    php70-mcrypt-7.0.21-1.23.amzn1.x86_64
    php70-7.0.21-1.23.amzn1.x86_64
    php70-gd-7.0.21-1.23.amzn1.x86_64
    php70-pdo-dblib-7.0.21-1.23.amzn1.x86_64
    php70-gmp-7.0.21-1.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions


CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2017-867.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Null pointer dereference

EUVDB-ID: #VU7349

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2017-9229

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger SIGSEGV in left_adjust_char_head() during regular expression compilation, cause NULL pointer dereference and the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update the affected packages.

i686:
    php70-imap-7.0.21-1.23.amzn1.i686
    php70-gd-7.0.21-1.23.amzn1.i686
    php70-fpm-7.0.21-1.23.amzn1.i686
    php70-7.0.21-1.23.amzn1.i686
    php70-pdo-dblib-7.0.21-1.23.amzn1.i686
    php70-debuginfo-7.0.21-1.23.amzn1.i686
    php70-common-7.0.21-1.23.amzn1.i686
    php70-gmp-7.0.21-1.23.amzn1.i686
    php70-ldap-7.0.21-1.23.amzn1.i686
    php70-odbc-7.0.21-1.23.amzn1.i686
    php70-devel-7.0.21-1.23.amzn1.i686
    php70-enchant-7.0.21-1.23.amzn1.i686
    php70-snmp-7.0.21-1.23.amzn1.i686
    php70-json-7.0.21-1.23.amzn1.i686
    php70-mcrypt-7.0.21-1.23.amzn1.i686
    php70-process-7.0.21-1.23.amzn1.i686
    php70-intl-7.0.21-1.23.amzn1.i686
    php70-soap-7.0.21-1.23.amzn1.i686
    php70-mysqlnd-7.0.21-1.23.amzn1.i686
    php70-dbg-7.0.21-1.23.amzn1.i686
    php70-dba-7.0.21-1.23.amzn1.i686
    php70-pgsql-7.0.21-1.23.amzn1.i686
    php70-recode-7.0.21-1.23.amzn1.i686
    php70-pdo-7.0.21-1.23.amzn1.i686
    php70-zip-7.0.21-1.23.amzn1.i686
    php70-embedded-7.0.21-1.23.amzn1.i686
    php70-mbstring-7.0.21-1.23.amzn1.i686
    php70-pspell-7.0.21-1.23.amzn1.i686
    php70-opcache-7.0.21-1.23.amzn1.i686
    php70-xmlrpc-7.0.21-1.23.amzn1.i686
    php70-bcmath-7.0.21-1.23.amzn1.i686
    php70-tidy-7.0.21-1.23.amzn1.i686
    php70-xml-7.0.21-1.23.amzn1.i686
    php70-cli-7.0.21-1.23.amzn1.i686

src:
    php70-7.0.21-1.23.amzn1.src

x86_64:
    php70-mysqlnd-7.0.21-1.23.amzn1.x86_64
    php70-xml-7.0.21-1.23.amzn1.x86_64
    php70-cli-7.0.21-1.23.amzn1.x86_64
    php70-pspell-7.0.21-1.23.amzn1.x86_64
    php70-fpm-7.0.21-1.23.amzn1.x86_64
    php70-embedded-7.0.21-1.23.amzn1.x86_64
    php70-intl-7.0.21-1.23.amzn1.x86_64
    php70-recode-7.0.21-1.23.amzn1.x86_64
    php70-common-7.0.21-1.23.amzn1.x86_64
    php70-pgsql-7.0.21-1.23.amzn1.x86_64
    php70-odbc-7.0.21-1.23.amzn1.x86_64
    php70-mbstring-7.0.21-1.23.amzn1.x86_64
    php70-dbg-7.0.21-1.23.amzn1.x86_64
    php70-pdo-7.0.21-1.23.amzn1.x86_64
    php70-devel-7.0.21-1.23.amzn1.x86_64
    php70-enchant-7.0.21-1.23.amzn1.x86_64
    php70-snmp-7.0.21-1.23.amzn1.x86_64
    php70-process-7.0.21-1.23.amzn1.x86_64
    php70-debuginfo-7.0.21-1.23.amzn1.x86_64
    php70-imap-7.0.21-1.23.amzn1.x86_64
    php70-zip-7.0.21-1.23.amzn1.x86_64
    php70-ldap-7.0.21-1.23.amzn1.x86_64
    php70-json-7.0.21-1.23.amzn1.x86_64
    php70-xmlrpc-7.0.21-1.23.amzn1.x86_64
    php70-tidy-7.0.21-1.23.amzn1.x86_64
    php70-opcache-7.0.21-1.23.amzn1.x86_64
    php70-bcmath-7.0.21-1.23.amzn1.x86_64
    php70-dba-7.0.21-1.23.amzn1.x86_64
    php70-soap-7.0.21-1.23.amzn1.x86_64
    php70-mcrypt-7.0.21-1.23.amzn1.x86_64
    php70-7.0.21-1.23.amzn1.x86_64
    php70-gd-7.0.21-1.23.amzn1.x86_64
    php70-pdo-dblib-7.0.21-1.23.amzn1.x86_64
    php70-gmp-7.0.21-1.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions


CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2017-867.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Heap-out-of-bounds write

EUVDB-ID: #VU7346

Risk: High

CVSSv3.1:

CVE-ID: CVE-2017-9226

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists in the mbstring due to heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. A remote attacker can supply a malformed regular expression containing an octal number in the form of '\700', trigger
out-of-bounds write memory corruption and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected packages.

i686:
    php70-imap-7.0.21-1.23.amzn1.i686
    php70-gd-7.0.21-1.23.amzn1.i686
    php70-fpm-7.0.21-1.23.amzn1.i686
    php70-7.0.21-1.23.amzn1.i686
    php70-pdo-dblib-7.0.21-1.23.amzn1.i686
    php70-debuginfo-7.0.21-1.23.amzn1.i686
    php70-common-7.0.21-1.23.amzn1.i686
    php70-gmp-7.0.21-1.23.amzn1.i686
    php70-ldap-7.0.21-1.23.amzn1.i686
    php70-odbc-7.0.21-1.23.amzn1.i686
    php70-devel-7.0.21-1.23.amzn1.i686
    php70-enchant-7.0.21-1.23.amzn1.i686
    php70-snmp-7.0.21-1.23.amzn1.i686
    php70-json-7.0.21-1.23.amzn1.i686
    php70-mcrypt-7.0.21-1.23.amzn1.i686
    php70-process-7.0.21-1.23.amzn1.i686
    php70-intl-7.0.21-1.23.amzn1.i686
    php70-soap-7.0.21-1.23.amzn1.i686
    php70-mysqlnd-7.0.21-1.23.amzn1.i686
    php70-dbg-7.0.21-1.23.amzn1.i686
    php70-dba-7.0.21-1.23.amzn1.i686
    php70-pgsql-7.0.21-1.23.amzn1.i686
    php70-recode-7.0.21-1.23.amzn1.i686
    php70-pdo-7.0.21-1.23.amzn1.i686
    php70-zip-7.0.21-1.23.amzn1.i686
    php70-embedded-7.0.21-1.23.amzn1.i686
    php70-mbstring-7.0.21-1.23.amzn1.i686
    php70-pspell-7.0.21-1.23.amzn1.i686
    php70-opcache-7.0.21-1.23.amzn1.i686
    php70-xmlrpc-7.0.21-1.23.amzn1.i686
    php70-bcmath-7.0.21-1.23.amzn1.i686
    php70-tidy-7.0.21-1.23.amzn1.i686
    php70-xml-7.0.21-1.23.amzn1.i686
    php70-cli-7.0.21-1.23.amzn1.i686

src:
    php70-7.0.21-1.23.amzn1.src

x86_64:
    php70-mysqlnd-7.0.21-1.23.amzn1.x86_64
    php70-xml-7.0.21-1.23.amzn1.x86_64
    php70-cli-7.0.21-1.23.amzn1.x86_64
    php70-pspell-7.0.21-1.23.amzn1.x86_64
    php70-fpm-7.0.21-1.23.amzn1.x86_64
    php70-embedded-7.0.21-1.23.amzn1.x86_64
    php70-intl-7.0.21-1.23.amzn1.x86_64
    php70-recode-7.0.21-1.23.amzn1.x86_64
    php70-common-7.0.21-1.23.amzn1.x86_64
    php70-pgsql-7.0.21-1.23.amzn1.x86_64
    php70-odbc-7.0.21-1.23.amzn1.x86_64
    php70-mbstring-7.0.21-1.23.amzn1.x86_64
    php70-dbg-7.0.21-1.23.amzn1.x86_64
    php70-pdo-7.0.21-1.23.amzn1.x86_64
    php70-devel-7.0.21-1.23.amzn1.x86_64
    php70-enchant-7.0.21-1.23.amzn1.x86_64
    php70-snmp-7.0.21-1.23.amzn1.x86_64
    php70-process-7.0.21-1.23.amzn1.x86_64
    php70-debuginfo-7.0.21-1.23.amzn1.x86_64
    php70-imap-7.0.21-1.23.amzn1.x86_64
    php70-zip-7.0.21-1.23.amzn1.x86_64
    php70-ldap-7.0.21-1.23.amzn1.x86_64
    php70-json-7.0.21-1.23.amzn1.x86_64
    php70-xmlrpc-7.0.21-1.23.amzn1.x86_64
    php70-tidy-7.0.21-1.23.amzn1.x86_64
    php70-opcache-7.0.21-1.23.amzn1.x86_64
    php70-bcmath-7.0.21-1.23.amzn1.x86_64
    php70-dba-7.0.21-1.23.amzn1.x86_64
    php70-soap-7.0.21-1.23.amzn1.x86_64
    php70-mcrypt-7.0.21-1.23.amzn1.x86_64
    php70-7.0.21-1.23.amzn1.x86_64
    php70-gd-7.0.21-1.23.amzn1.x86_64
    php70-pdo-dblib-7.0.21-1.23.amzn1.x86_64
    php70-gmp-7.0.21-1.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions


CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2017-867.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Out-of-bounds read

EUVDB-ID: #VU7347

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2017-9227

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger stack out-of-bounds read in mbc_enc_len() during regular expression searching and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Update the affected packages.

i686:
    php70-imap-7.0.21-1.23.amzn1.i686
    php70-gd-7.0.21-1.23.amzn1.i686
    php70-fpm-7.0.21-1.23.amzn1.i686
    php70-7.0.21-1.23.amzn1.i686
    php70-pdo-dblib-7.0.21-1.23.amzn1.i686
    php70-debuginfo-7.0.21-1.23.amzn1.i686
    php70-common-7.0.21-1.23.amzn1.i686
    php70-gmp-7.0.21-1.23.amzn1.i686
    php70-ldap-7.0.21-1.23.amzn1.i686
    php70-odbc-7.0.21-1.23.amzn1.i686
    php70-devel-7.0.21-1.23.amzn1.i686
    php70-enchant-7.0.21-1.23.amzn1.i686
    php70-snmp-7.0.21-1.23.amzn1.i686
    php70-json-7.0.21-1.23.amzn1.i686
    php70-mcrypt-7.0.21-1.23.amzn1.i686
    php70-process-7.0.21-1.23.amzn1.i686
    php70-intl-7.0.21-1.23.amzn1.i686
    php70-soap-7.0.21-1.23.amzn1.i686
    php70-mysqlnd-7.0.21-1.23.amzn1.i686
    php70-dbg-7.0.21-1.23.amzn1.i686
    php70-dba-7.0.21-1.23.amzn1.i686
    php70-pgsql-7.0.21-1.23.amzn1.i686
    php70-recode-7.0.21-1.23.amzn1.i686
    php70-pdo-7.0.21-1.23.amzn1.i686
    php70-zip-7.0.21-1.23.amzn1.i686
    php70-embedded-7.0.21-1.23.amzn1.i686
    php70-mbstring-7.0.21-1.23.amzn1.i686
    php70-pspell-7.0.21-1.23.amzn1.i686
    php70-opcache-7.0.21-1.23.amzn1.i686
    php70-xmlrpc-7.0.21-1.23.amzn1.i686
    php70-bcmath-7.0.21-1.23.amzn1.i686
    php70-tidy-7.0.21-1.23.amzn1.i686
    php70-xml-7.0.21-1.23.amzn1.i686
    php70-cli-7.0.21-1.23.amzn1.i686

src:
    php70-7.0.21-1.23.amzn1.src

x86_64:
    php70-mysqlnd-7.0.21-1.23.amzn1.x86_64
    php70-xml-7.0.21-1.23.amzn1.x86_64
    php70-cli-7.0.21-1.23.amzn1.x86_64
    php70-pspell-7.0.21-1.23.amzn1.x86_64
    php70-fpm-7.0.21-1.23.amzn1.x86_64
    php70-embedded-7.0.21-1.23.amzn1.x86_64
    php70-intl-7.0.21-1.23.amzn1.x86_64
    php70-recode-7.0.21-1.23.amzn1.x86_64
    php70-common-7.0.21-1.23.amzn1.x86_64
    php70-pgsql-7.0.21-1.23.amzn1.x86_64
    php70-odbc-7.0.21-1.23.amzn1.x86_64
    php70-mbstring-7.0.21-1.23.amzn1.x86_64
    php70-dbg-7.0.21-1.23.amzn1.x86_64
    php70-pdo-7.0.21-1.23.amzn1.x86_64
    php70-devel-7.0.21-1.23.amzn1.x86_64
    php70-enchant-7.0.21-1.23.amzn1.x86_64
    php70-snmp-7.0.21-1.23.amzn1.x86_64
    php70-process-7.0.21-1.23.amzn1.x86_64
    php70-debuginfo-7.0.21-1.23.amzn1.x86_64
    php70-imap-7.0.21-1.23.amzn1.x86_64
    php70-zip-7.0.21-1.23.amzn1.x86_64
    php70-ldap-7.0.21-1.23.amzn1.x86_64
    php70-json-7.0.21-1.23.amzn1.x86_64
    php70-xmlrpc-7.0.21-1.23.amzn1.x86_64
    php70-tidy-7.0.21-1.23.amzn1.x86_64
    php70-opcache-7.0.21-1.23.amzn1.x86_64
    php70-bcmath-7.0.21-1.23.amzn1.x86_64
    php70-dba-7.0.21-1.23.amzn1.x86_64
    php70-soap-7.0.21-1.23.amzn1.x86_64
    php70-mcrypt-7.0.21-1.23.amzn1.x86_64
    php70-7.0.21-1.23.amzn1.x86_64
    php70-gd-7.0.21-1.23.amzn1.x86_64
    php70-pdo-dblib-7.0.21-1.23.amzn1.x86_64
    php70-gmp-7.0.21-1.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions


CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2017-867.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) Out-of-bounds read

EUVDB-ID: #VU7345

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2017-9224

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the mbstring due to stack out-of-bounds read in match_at() during regular expression searching. A remote attacker can trigger a logical error involving order of validation and access in match_at() and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Update the affected packages.

i686:
    php70-imap-7.0.21-1.23.amzn1.i686
    php70-gd-7.0.21-1.23.amzn1.i686
    php70-fpm-7.0.21-1.23.amzn1.i686
    php70-7.0.21-1.23.amzn1.i686
    php70-pdo-dblib-7.0.21-1.23.amzn1.i686
    php70-debuginfo-7.0.21-1.23.amzn1.i686
    php70-common-7.0.21-1.23.amzn1.i686
    php70-gmp-7.0.21-1.23.amzn1.i686
    php70-ldap-7.0.21-1.23.amzn1.i686
    php70-odbc-7.0.21-1.23.amzn1.i686
    php70-devel-7.0.21-1.23.amzn1.i686
    php70-enchant-7.0.21-1.23.amzn1.i686
    php70-snmp-7.0.21-1.23.amzn1.i686
    php70-json-7.0.21-1.23.amzn1.i686
    php70-mcrypt-7.0.21-1.23.amzn1.i686
    php70-process-7.0.21-1.23.amzn1.i686
    php70-intl-7.0.21-1.23.amzn1.i686
    php70-soap-7.0.21-1.23.amzn1.i686
    php70-mysqlnd-7.0.21-1.23.amzn1.i686
    php70-dbg-7.0.21-1.23.amzn1.i686
    php70-dba-7.0.21-1.23.amzn1.i686
    php70-pgsql-7.0.21-1.23.amzn1.i686
    php70-recode-7.0.21-1.23.amzn1.i686
    php70-pdo-7.0.21-1.23.amzn1.i686
    php70-zip-7.0.21-1.23.amzn1.i686
    php70-embedded-7.0.21-1.23.amzn1.i686
    php70-mbstring-7.0.21-1.23.amzn1.i686
    php70-pspell-7.0.21-1.23.amzn1.i686
    php70-opcache-7.0.21-1.23.amzn1.i686
    php70-xmlrpc-7.0.21-1.23.amzn1.i686
    php70-bcmath-7.0.21-1.23.amzn1.i686
    php70-tidy-7.0.21-1.23.amzn1.i686
    php70-xml-7.0.21-1.23.amzn1.i686
    php70-cli-7.0.21-1.23.amzn1.i686

src:
    php70-7.0.21-1.23.amzn1.src

x86_64:
    php70-mysqlnd-7.0.21-1.23.amzn1.x86_64
    php70-xml-7.0.21-1.23.amzn1.x86_64
    php70-cli-7.0.21-1.23.amzn1.x86_64
    php70-pspell-7.0.21-1.23.amzn1.x86_64
    php70-fpm-7.0.21-1.23.amzn1.x86_64
    php70-embedded-7.0.21-1.23.amzn1.x86_64
    php70-intl-7.0.21-1.23.amzn1.x86_64
    php70-recode-7.0.21-1.23.amzn1.x86_64
    php70-common-7.0.21-1.23.amzn1.x86_64
    php70-pgsql-7.0.21-1.23.amzn1.x86_64
    php70-odbc-7.0.21-1.23.amzn1.x86_64
    php70-mbstring-7.0.21-1.23.amzn1.x86_64
    php70-dbg-7.0.21-1.23.amzn1.x86_64
    php70-pdo-7.0.21-1.23.amzn1.x86_64
    php70-devel-7.0.21-1.23.amzn1.x86_64
    php70-enchant-7.0.21-1.23.amzn1.x86_64
    php70-snmp-7.0.21-1.23.amzn1.x86_64
    php70-process-7.0.21-1.23.amzn1.x86_64
    php70-debuginfo-7.0.21-1.23.amzn1.x86_64
    php70-imap-7.0.21-1.23.amzn1.x86_64
    php70-zip-7.0.21-1.23.amzn1.x86_64
    php70-ldap-7.0.21-1.23.amzn1.x86_64
    php70-json-7.0.21-1.23.amzn1.x86_64
    php70-xmlrpc-7.0.21-1.23.amzn1.x86_64
    php70-tidy-7.0.21-1.23.amzn1.x86_64
    php70-opcache-7.0.21-1.23.amzn1.x86_64
    php70-bcmath-7.0.21-1.23.amzn1.x86_64
    php70-dba-7.0.21-1.23.amzn1.x86_64
    php70-soap-7.0.21-1.23.amzn1.x86_64
    php70-mcrypt-7.0.21-1.23.amzn1.x86_64
    php70-7.0.21-1.23.amzn1.x86_64
    php70-gd-7.0.21-1.23.amzn1.x86_64
    php70-pdo-dblib-7.0.21-1.23.amzn1.x86_64
    php70-gmp-7.0.21-1.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions


CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2017-867.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###