Amazon Linux AMI update for php70

Published: 2017-08-03

Risk	High
Patch available	YES
Number of vulnerabilities	6
CVE-ID	CVE-2017-9228 CVE-2017-7890 CVE-2017-9229 CVE-2017-9226 CVE-2017-9227 CVE-2017-9224
CWE-ID	CWE-787 CWE-200 CWE-476 CWE-125
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Amazon Linux AMI Operating systems & Components / Operating system
Vendor	Amazon Web Services

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Heap-out-of-bounds write

EUVDB-ID: #VU7348

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-9228

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists in the mbstring due to heap out-of-bounds write in bitset_set_range() during regular expression compilation due to incorrect state transition in parse_char_class(). A remote attacker can trigger out-of-bounds write memory corruption and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected packages.

i686:
    php70-imap-7.0.21-1.23.amzn1.i686
    php70-gd-7.0.21-1.23.amzn1.i686
    php70-fpm-7.0.21-1.23.amzn1.i686
    php70-7.0.21-1.23.amzn1.i686
    php70-pdo-dblib-7.0.21-1.23.amzn1.i686
    php70-debuginfo-7.0.21-1.23.amzn1.i686
    php70-common-7.0.21-1.23.amzn1.i686
    php70-gmp-7.0.21-1.23.amzn1.i686
    php70-ldap-7.0.21-1.23.amzn1.i686
    php70-odbc-7.0.21-1.23.amzn1.i686
    php70-devel-7.0.21-1.23.amzn1.i686
    php70-enchant-7.0.21-1.23.amzn1.i686
    php70-snmp-7.0.21-1.23.amzn1.i686
    php70-json-7.0.21-1.23.amzn1.i686
    php70-mcrypt-7.0.21-1.23.amzn1.i686
    php70-process-7.0.21-1.23.amzn1.i686
    php70-intl-7.0.21-1.23.amzn1.i686
    php70-soap-7.0.21-1.23.amzn1.i686
    php70-mysqlnd-7.0.21-1.23.amzn1.i686
    php70-dbg-7.0.21-1.23.amzn1.i686
    php70-dba-7.0.21-1.23.amzn1.i686
    php70-pgsql-7.0.21-1.23.amzn1.i686
    php70-recode-7.0.21-1.23.amzn1.i686
    php70-pdo-7.0.21-1.23.amzn1.i686
    php70-zip-7.0.21-1.23.amzn1.i686
    php70-embedded-7.0.21-1.23.amzn1.i686
    php70-mbstring-7.0.21-1.23.amzn1.i686
    php70-pspell-7.0.21-1.23.amzn1.i686
    php70-opcache-7.0.21-1.23.amzn1.i686
    php70-xmlrpc-7.0.21-1.23.amzn1.i686
    php70-bcmath-7.0.21-1.23.amzn1.i686
    php70-tidy-7.0.21-1.23.amzn1.i686
    php70-xml-7.0.21-1.23.amzn1.i686
    php70-cli-7.0.21-1.23.amzn1.i686

src:
    php70-7.0.21-1.23.amzn1.src

x86_64:
    php70-mysqlnd-7.0.21-1.23.amzn1.x86_64
    php70-xml-7.0.21-1.23.amzn1.x86_64
    php70-cli-7.0.21-1.23.amzn1.x86_64
    php70-pspell-7.0.21-1.23.amzn1.x86_64
    php70-fpm-7.0.21-1.23.amzn1.x86_64
    php70-embedded-7.0.21-1.23.amzn1.x86_64
    php70-intl-7.0.21-1.23.amzn1.x86_64
    php70-recode-7.0.21-1.23.amzn1.x86_64
    php70-common-7.0.21-1.23.amzn1.x86_64
    php70-pgsql-7.0.21-1.23.amzn1.x86_64
    php70-odbc-7.0.21-1.23.amzn1.x86_64
    php70-mbstring-7.0.21-1.23.amzn1.x86_64
    php70-dbg-7.0.21-1.23.amzn1.x86_64
    php70-pdo-7.0.21-1.23.amzn1.x86_64
    php70-devel-7.0.21-1.23.amzn1.x86_64
    php70-enchant-7.0.21-1.23.amzn1.x86_64
    php70-snmp-7.0.21-1.23.amzn1.x86_64
    php70-process-7.0.21-1.23.amzn1.x86_64
    php70-debuginfo-7.0.21-1.23.amzn1.x86_64
    php70-imap-7.0.21-1.23.amzn1.x86_64
    php70-zip-7.0.21-1.23.amzn1.x86_64
    php70-ldap-7.0.21-1.23.amzn1.x86_64
    php70-json-7.0.21-1.23.amzn1.x86_64
    php70-xmlrpc-7.0.21-1.23.amzn1.x86_64
    php70-tidy-7.0.21-1.23.amzn1.x86_64
    php70-opcache-7.0.21-1.23.amzn1.x86_64
    php70-bcmath-7.0.21-1.23.amzn1.x86_64
    php70-dba-7.0.21-1.23.amzn1.x86_64
    php70-soap-7.0.21-1.23.amzn1.x86_64
    php70-mcrypt-7.0.21-1.23.amzn1.x86_64
    php70-7.0.21-1.23.amzn1.x86_64
    php70-gd-7.0.21-1.23.amzn1.x86_64
    php70-pdo-dblib-7.0.21-1.23.amzn1.x86_64
    php70-gmp-7.0.21-1.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2017-867.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU11789

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-7890

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c due to it does not zero colorMap arrays before use. A remote attacker can trick the victim into opening a specially crafted GIF image that could use the uninitialized tables to read ~700 bytes from the top of the stack and gain access to potentially sensitive information.

Mitigation

Update the affected packages.

i686:
    php70-imap-7.0.21-1.23.amzn1.i686
    php70-gd-7.0.21-1.23.amzn1.i686
    php70-fpm-7.0.21-1.23.amzn1.i686
    php70-7.0.21-1.23.amzn1.i686
    php70-pdo-dblib-7.0.21-1.23.amzn1.i686
    php70-debuginfo-7.0.21-1.23.amzn1.i686
    php70-common-7.0.21-1.23.amzn1.i686
    php70-gmp-7.0.21-1.23.amzn1.i686
    php70-ldap-7.0.21-1.23.amzn1.i686
    php70-odbc-7.0.21-1.23.amzn1.i686
    php70-devel-7.0.21-1.23.amzn1.i686
    php70-enchant-7.0.21-1.23.amzn1.i686
    php70-snmp-7.0.21-1.23.amzn1.i686
    php70-json-7.0.21-1.23.amzn1.i686
    php70-mcrypt-7.0.21-1.23.amzn1.i686
    php70-process-7.0.21-1.23.amzn1.i686
    php70-intl-7.0.21-1.23.amzn1.i686
    php70-soap-7.0.21-1.23.amzn1.i686
    php70-mysqlnd-7.0.21-1.23.amzn1.i686
    php70-dbg-7.0.21-1.23.amzn1.i686
    php70-dba-7.0.21-1.23.amzn1.i686
    php70-pgsql-7.0.21-1.23.amzn1.i686
    php70-recode-7.0.21-1.23.amzn1.i686
    php70-pdo-7.0.21-1.23.amzn1.i686
    php70-zip-7.0.21-1.23.amzn1.i686
    php70-embedded-7.0.21-1.23.amzn1.i686
    php70-mbstring-7.0.21-1.23.amzn1.i686
    php70-pspell-7.0.21-1.23.amzn1.i686
    php70-opcache-7.0.21-1.23.amzn1.i686
    php70-xmlrpc-7.0.21-1.23.amzn1.i686
    php70-bcmath-7.0.21-1.23.amzn1.i686
    php70-tidy-7.0.21-1.23.amzn1.i686
    php70-xml-7.0.21-1.23.amzn1.i686
    php70-cli-7.0.21-1.23.amzn1.i686

src:
    php70-7.0.21-1.23.amzn1.src

x86_64:
    php70-mysqlnd-7.0.21-1.23.amzn1.x86_64
    php70-xml-7.0.21-1.23.amzn1.x86_64
    php70-cli-7.0.21-1.23.amzn1.x86_64
    php70-pspell-7.0.21-1.23.amzn1.x86_64
    php70-fpm-7.0.21-1.23.amzn1.x86_64
    php70-embedded-7.0.21-1.23.amzn1.x86_64
    php70-intl-7.0.21-1.23.amzn1.x86_64
    php70-recode-7.0.21-1.23.amzn1.x86_64
    php70-common-7.0.21-1.23.amzn1.x86_64
    php70-pgsql-7.0.21-1.23.amzn1.x86_64
    php70-odbc-7.0.21-1.23.amzn1.x86_64
    php70-mbstring-7.0.21-1.23.amzn1.x86_64
    php70-dbg-7.0.21-1.23.amzn1.x86_64
    php70-pdo-7.0.21-1.23.amzn1.x86_64
    php70-devel-7.0.21-1.23.amzn1.x86_64
    php70-enchant-7.0.21-1.23.amzn1.x86_64
    php70-snmp-7.0.21-1.23.amzn1.x86_64
    php70-process-7.0.21-1.23.amzn1.x86_64
    php70-debuginfo-7.0.21-1.23.amzn1.x86_64
    php70-imap-7.0.21-1.23.amzn1.x86_64
    php70-zip-7.0.21-1.23.amzn1.x86_64
    php70-ldap-7.0.21-1.23.amzn1.x86_64
    php70-json-7.0.21-1.23.amzn1.x86_64
    php70-xmlrpc-7.0.21-1.23.amzn1.x86_64
    php70-tidy-7.0.21-1.23.amzn1.x86_64
    php70-opcache-7.0.21-1.23.amzn1.x86_64
    php70-bcmath-7.0.21-1.23.amzn1.x86_64
    php70-dba-7.0.21-1.23.amzn1.x86_64
    php70-soap-7.0.21-1.23.amzn1.x86_64
    php70-mcrypt-7.0.21-1.23.amzn1.x86_64
    php70-7.0.21-1.23.amzn1.x86_64
    php70-gd-7.0.21-1.23.amzn1.x86_64
    php70-pdo-dblib-7.0.21-1.23.amzn1.x86_64
    php70-gmp-7.0.21-1.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2017-867.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Null pointer dereference

EUVDB-ID: #VU7349

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-9229

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger SIGSEGV in left_adjust_char_head() during regular expression compilation, cause NULL pointer dereference and the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update the affected packages.

i686:
    php70-imap-7.0.21-1.23.amzn1.i686
    php70-gd-7.0.21-1.23.amzn1.i686
    php70-fpm-7.0.21-1.23.amzn1.i686
    php70-7.0.21-1.23.amzn1.i686
    php70-pdo-dblib-7.0.21-1.23.amzn1.i686
    php70-debuginfo-7.0.21-1.23.amzn1.i686
    php70-common-7.0.21-1.23.amzn1.i686
    php70-gmp-7.0.21-1.23.amzn1.i686
    php70-ldap-7.0.21-1.23.amzn1.i686
    php70-odbc-7.0.21-1.23.amzn1.i686
    php70-devel-7.0.21-1.23.amzn1.i686
    php70-enchant-7.0.21-1.23.amzn1.i686
    php70-snmp-7.0.21-1.23.amzn1.i686
    php70-json-7.0.21-1.23.amzn1.i686
    php70-mcrypt-7.0.21-1.23.amzn1.i686
    php70-process-7.0.21-1.23.amzn1.i686
    php70-intl-7.0.21-1.23.amzn1.i686
    php70-soap-7.0.21-1.23.amzn1.i686
    php70-mysqlnd-7.0.21-1.23.amzn1.i686
    php70-dbg-7.0.21-1.23.amzn1.i686
    php70-dba-7.0.21-1.23.amzn1.i686
    php70-pgsql-7.0.21-1.23.amzn1.i686
    php70-recode-7.0.21-1.23.amzn1.i686
    php70-pdo-7.0.21-1.23.amzn1.i686
    php70-zip-7.0.21-1.23.amzn1.i686
    php70-embedded-7.0.21-1.23.amzn1.i686
    php70-mbstring-7.0.21-1.23.amzn1.i686
    php70-pspell-7.0.21-1.23.amzn1.i686
    php70-opcache-7.0.21-1.23.amzn1.i686
    php70-xmlrpc-7.0.21-1.23.amzn1.i686
    php70-bcmath-7.0.21-1.23.amzn1.i686
    php70-tidy-7.0.21-1.23.amzn1.i686
    php70-xml-7.0.21-1.23.amzn1.i686
    php70-cli-7.0.21-1.23.amzn1.i686

src:
    php70-7.0.21-1.23.amzn1.src

x86_64:
    php70-mysqlnd-7.0.21-1.23.amzn1.x86_64
    php70-xml-7.0.21-1.23.amzn1.x86_64
    php70-cli-7.0.21-1.23.amzn1.x86_64
    php70-pspell-7.0.21-1.23.amzn1.x86_64
    php70-fpm-7.0.21-1.23.amzn1.x86_64
    php70-embedded-7.0.21-1.23.amzn1.x86_64
    php70-intl-7.0.21-1.23.amzn1.x86_64
    php70-recode-7.0.21-1.23.amzn1.x86_64
    php70-common-7.0.21-1.23.amzn1.x86_64
    php70-pgsql-7.0.21-1.23.amzn1.x86_64
    php70-odbc-7.0.21-1.23.amzn1.x86_64
    php70-mbstring-7.0.21-1.23.amzn1.x86_64
    php70-dbg-7.0.21-1.23.amzn1.x86_64
    php70-pdo-7.0.21-1.23.amzn1.x86_64
    php70-devel-7.0.21-1.23.amzn1.x86_64
    php70-enchant-7.0.21-1.23.amzn1.x86_64
    php70-snmp-7.0.21-1.23.amzn1.x86_64
    php70-process-7.0.21-1.23.amzn1.x86_64
    php70-debuginfo-7.0.21-1.23.amzn1.x86_64
    php70-imap-7.0.21-1.23.amzn1.x86_64
    php70-zip-7.0.21-1.23.amzn1.x86_64
    php70-ldap-7.0.21-1.23.amzn1.x86_64
    php70-json-7.0.21-1.23.amzn1.x86_64
    php70-xmlrpc-7.0.21-1.23.amzn1.x86_64
    php70-tidy-7.0.21-1.23.amzn1.x86_64
    php70-opcache-7.0.21-1.23.amzn1.x86_64
    php70-bcmath-7.0.21-1.23.amzn1.x86_64
    php70-dba-7.0.21-1.23.amzn1.x86_64
    php70-soap-7.0.21-1.23.amzn1.x86_64
    php70-mcrypt-7.0.21-1.23.amzn1.x86_64
    php70-7.0.21-1.23.amzn1.x86_64
    php70-gd-7.0.21-1.23.amzn1.x86_64
    php70-pdo-dblib-7.0.21-1.23.amzn1.x86_64
    php70-gmp-7.0.21-1.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2017-867.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Heap-out-of-bounds write

EUVDB-ID: #VU7346

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-9226

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists in the mbstring due to heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. A remote attacker can supply a malformed regular expression containing an octal number in the form of '\700', trigger
out-of-bounds write memory corruption and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected packages.

i686:
    php70-imap-7.0.21-1.23.amzn1.i686
    php70-gd-7.0.21-1.23.amzn1.i686
    php70-fpm-7.0.21-1.23.amzn1.i686
    php70-7.0.21-1.23.amzn1.i686
    php70-pdo-dblib-7.0.21-1.23.amzn1.i686
    php70-debuginfo-7.0.21-1.23.amzn1.i686
    php70-common-7.0.21-1.23.amzn1.i686
    php70-gmp-7.0.21-1.23.amzn1.i686
    php70-ldap-7.0.21-1.23.amzn1.i686
    php70-odbc-7.0.21-1.23.amzn1.i686
    php70-devel-7.0.21-1.23.amzn1.i686
    php70-enchant-7.0.21-1.23.amzn1.i686
    php70-snmp-7.0.21-1.23.amzn1.i686
    php70-json-7.0.21-1.23.amzn1.i686
    php70-mcrypt-7.0.21-1.23.amzn1.i686
    php70-process-7.0.21-1.23.amzn1.i686
    php70-intl-7.0.21-1.23.amzn1.i686
    php70-soap-7.0.21-1.23.amzn1.i686
    php70-mysqlnd-7.0.21-1.23.amzn1.i686
    php70-dbg-7.0.21-1.23.amzn1.i686
    php70-dba-7.0.21-1.23.amzn1.i686
    php70-pgsql-7.0.21-1.23.amzn1.i686
    php70-recode-7.0.21-1.23.amzn1.i686
    php70-pdo-7.0.21-1.23.amzn1.i686
    php70-zip-7.0.21-1.23.amzn1.i686
    php70-embedded-7.0.21-1.23.amzn1.i686
    php70-mbstring-7.0.21-1.23.amzn1.i686
    php70-pspell-7.0.21-1.23.amzn1.i686
    php70-opcache-7.0.21-1.23.amzn1.i686
    php70-xmlrpc-7.0.21-1.23.amzn1.i686
    php70-bcmath-7.0.21-1.23.amzn1.i686
    php70-tidy-7.0.21-1.23.amzn1.i686
    php70-xml-7.0.21-1.23.amzn1.i686
    php70-cli-7.0.21-1.23.amzn1.i686

src:
    php70-7.0.21-1.23.amzn1.src

x86_64:
    php70-mysqlnd-7.0.21-1.23.amzn1.x86_64
    php70-xml-7.0.21-1.23.amzn1.x86_64
    php70-cli-7.0.21-1.23.amzn1.x86_64
    php70-pspell-7.0.21-1.23.amzn1.x86_64
    php70-fpm-7.0.21-1.23.amzn1.x86_64
    php70-embedded-7.0.21-1.23.amzn1.x86_64
    php70-intl-7.0.21-1.23.amzn1.x86_64
    php70-recode-7.0.21-1.23.amzn1.x86_64
    php70-common-7.0.21-1.23.amzn1.x86_64
    php70-pgsql-7.0.21-1.23.amzn1.x86_64
    php70-odbc-7.0.21-1.23.amzn1.x86_64
    php70-mbstring-7.0.21-1.23.amzn1.x86_64
    php70-dbg-7.0.21-1.23.amzn1.x86_64
    php70-pdo-7.0.21-1.23.amzn1.x86_64
    php70-devel-7.0.21-1.23.amzn1.x86_64
    php70-enchant-7.0.21-1.23.amzn1.x86_64
    php70-snmp-7.0.21-1.23.amzn1.x86_64
    php70-process-7.0.21-1.23.amzn1.x86_64
    php70-debuginfo-7.0.21-1.23.amzn1.x86_64
    php70-imap-7.0.21-1.23.amzn1.x86_64
    php70-zip-7.0.21-1.23.amzn1.x86_64
    php70-ldap-7.0.21-1.23.amzn1.x86_64
    php70-json-7.0.21-1.23.amzn1.x86_64
    php70-xmlrpc-7.0.21-1.23.amzn1.x86_64
    php70-tidy-7.0.21-1.23.amzn1.x86_64
    php70-opcache-7.0.21-1.23.amzn1.x86_64
    php70-bcmath-7.0.21-1.23.amzn1.x86_64
    php70-dba-7.0.21-1.23.amzn1.x86_64
    php70-soap-7.0.21-1.23.amzn1.x86_64
    php70-mcrypt-7.0.21-1.23.amzn1.x86_64
    php70-7.0.21-1.23.amzn1.x86_64
    php70-gd-7.0.21-1.23.amzn1.x86_64
    php70-pdo-dblib-7.0.21-1.23.amzn1.x86_64
    php70-gmp-7.0.21-1.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2017-867.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU7347

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-9227

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger stack out-of-bounds read in mbc_enc_len() during regular expression searching and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Update the affected packages.

i686:
    php70-imap-7.0.21-1.23.amzn1.i686
    php70-gd-7.0.21-1.23.amzn1.i686
    php70-fpm-7.0.21-1.23.amzn1.i686
    php70-7.0.21-1.23.amzn1.i686
    php70-pdo-dblib-7.0.21-1.23.amzn1.i686
    php70-debuginfo-7.0.21-1.23.amzn1.i686
    php70-common-7.0.21-1.23.amzn1.i686
    php70-gmp-7.0.21-1.23.amzn1.i686
    php70-ldap-7.0.21-1.23.amzn1.i686
    php70-odbc-7.0.21-1.23.amzn1.i686
    php70-devel-7.0.21-1.23.amzn1.i686
    php70-enchant-7.0.21-1.23.amzn1.i686
    php70-snmp-7.0.21-1.23.amzn1.i686
    php70-json-7.0.21-1.23.amzn1.i686
    php70-mcrypt-7.0.21-1.23.amzn1.i686
    php70-process-7.0.21-1.23.amzn1.i686
    php70-intl-7.0.21-1.23.amzn1.i686
    php70-soap-7.0.21-1.23.amzn1.i686
    php70-mysqlnd-7.0.21-1.23.amzn1.i686
    php70-dbg-7.0.21-1.23.amzn1.i686
    php70-dba-7.0.21-1.23.amzn1.i686
    php70-pgsql-7.0.21-1.23.amzn1.i686
    php70-recode-7.0.21-1.23.amzn1.i686
    php70-pdo-7.0.21-1.23.amzn1.i686
    php70-zip-7.0.21-1.23.amzn1.i686
    php70-embedded-7.0.21-1.23.amzn1.i686
    php70-mbstring-7.0.21-1.23.amzn1.i686
    php70-pspell-7.0.21-1.23.amzn1.i686
    php70-opcache-7.0.21-1.23.amzn1.i686
    php70-xmlrpc-7.0.21-1.23.amzn1.i686
    php70-bcmath-7.0.21-1.23.amzn1.i686
    php70-tidy-7.0.21-1.23.amzn1.i686
    php70-xml-7.0.21-1.23.amzn1.i686
    php70-cli-7.0.21-1.23.amzn1.i686

src:
    php70-7.0.21-1.23.amzn1.src

x86_64:
    php70-mysqlnd-7.0.21-1.23.amzn1.x86_64
    php70-xml-7.0.21-1.23.amzn1.x86_64
    php70-cli-7.0.21-1.23.amzn1.x86_64
    php70-pspell-7.0.21-1.23.amzn1.x86_64
    php70-fpm-7.0.21-1.23.amzn1.x86_64
    php70-embedded-7.0.21-1.23.amzn1.x86_64
    php70-intl-7.0.21-1.23.amzn1.x86_64
    php70-recode-7.0.21-1.23.amzn1.x86_64
    php70-common-7.0.21-1.23.amzn1.x86_64
    php70-pgsql-7.0.21-1.23.amzn1.x86_64
    php70-odbc-7.0.21-1.23.amzn1.x86_64
    php70-mbstring-7.0.21-1.23.amzn1.x86_64
    php70-dbg-7.0.21-1.23.amzn1.x86_64
    php70-pdo-7.0.21-1.23.amzn1.x86_64
    php70-devel-7.0.21-1.23.amzn1.x86_64
    php70-enchant-7.0.21-1.23.amzn1.x86_64
    php70-snmp-7.0.21-1.23.amzn1.x86_64
    php70-process-7.0.21-1.23.amzn1.x86_64
    php70-debuginfo-7.0.21-1.23.amzn1.x86_64
    php70-imap-7.0.21-1.23.amzn1.x86_64
    php70-zip-7.0.21-1.23.amzn1.x86_64
    php70-ldap-7.0.21-1.23.amzn1.x86_64
    php70-json-7.0.21-1.23.amzn1.x86_64
    php70-xmlrpc-7.0.21-1.23.amzn1.x86_64
    php70-tidy-7.0.21-1.23.amzn1.x86_64
    php70-opcache-7.0.21-1.23.amzn1.x86_64
    php70-bcmath-7.0.21-1.23.amzn1.x86_64
    php70-dba-7.0.21-1.23.amzn1.x86_64
    php70-soap-7.0.21-1.23.amzn1.x86_64
    php70-mcrypt-7.0.21-1.23.amzn1.x86_64
    php70-7.0.21-1.23.amzn1.x86_64
    php70-gd-7.0.21-1.23.amzn1.x86_64
    php70-pdo-dblib-7.0.21-1.23.amzn1.x86_64
    php70-gmp-7.0.21-1.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2017-867.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds read

EUVDB-ID: #VU7345

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-9224

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the mbstring due to stack out-of-bounds read in match_at() during regular expression searching. A remote attacker can trigger a logical error involving order of validation and access in match_at() and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Update the affected packages.

i686:
    php70-imap-7.0.21-1.23.amzn1.i686
    php70-gd-7.0.21-1.23.amzn1.i686
    php70-fpm-7.0.21-1.23.amzn1.i686
    php70-7.0.21-1.23.amzn1.i686
    php70-pdo-dblib-7.0.21-1.23.amzn1.i686
    php70-debuginfo-7.0.21-1.23.amzn1.i686
    php70-common-7.0.21-1.23.amzn1.i686
    php70-gmp-7.0.21-1.23.amzn1.i686
    php70-ldap-7.0.21-1.23.amzn1.i686
    php70-odbc-7.0.21-1.23.amzn1.i686
    php70-devel-7.0.21-1.23.amzn1.i686
    php70-enchant-7.0.21-1.23.amzn1.i686
    php70-snmp-7.0.21-1.23.amzn1.i686
    php70-json-7.0.21-1.23.amzn1.i686
    php70-mcrypt-7.0.21-1.23.amzn1.i686
    php70-process-7.0.21-1.23.amzn1.i686
    php70-intl-7.0.21-1.23.amzn1.i686
    php70-soap-7.0.21-1.23.amzn1.i686
    php70-mysqlnd-7.0.21-1.23.amzn1.i686
    php70-dbg-7.0.21-1.23.amzn1.i686
    php70-dba-7.0.21-1.23.amzn1.i686
    php70-pgsql-7.0.21-1.23.amzn1.i686
    php70-recode-7.0.21-1.23.amzn1.i686
    php70-pdo-7.0.21-1.23.amzn1.i686
    php70-zip-7.0.21-1.23.amzn1.i686
    php70-embedded-7.0.21-1.23.amzn1.i686
    php70-mbstring-7.0.21-1.23.amzn1.i686
    php70-pspell-7.0.21-1.23.amzn1.i686
    php70-opcache-7.0.21-1.23.amzn1.i686
    php70-xmlrpc-7.0.21-1.23.amzn1.i686
    php70-bcmath-7.0.21-1.23.amzn1.i686
    php70-tidy-7.0.21-1.23.amzn1.i686
    php70-xml-7.0.21-1.23.amzn1.i686
    php70-cli-7.0.21-1.23.amzn1.i686

src:
    php70-7.0.21-1.23.amzn1.src

x86_64:
    php70-mysqlnd-7.0.21-1.23.amzn1.x86_64
    php70-xml-7.0.21-1.23.amzn1.x86_64
    php70-cli-7.0.21-1.23.amzn1.x86_64
    php70-pspell-7.0.21-1.23.amzn1.x86_64
    php70-fpm-7.0.21-1.23.amzn1.x86_64
    php70-embedded-7.0.21-1.23.amzn1.x86_64
    php70-intl-7.0.21-1.23.amzn1.x86_64
    php70-recode-7.0.21-1.23.amzn1.x86_64
    php70-common-7.0.21-1.23.amzn1.x86_64
    php70-pgsql-7.0.21-1.23.amzn1.x86_64
    php70-odbc-7.0.21-1.23.amzn1.x86_64
    php70-mbstring-7.0.21-1.23.amzn1.x86_64
    php70-dbg-7.0.21-1.23.amzn1.x86_64
    php70-pdo-7.0.21-1.23.amzn1.x86_64
    php70-devel-7.0.21-1.23.amzn1.x86_64
    php70-enchant-7.0.21-1.23.amzn1.x86_64
    php70-snmp-7.0.21-1.23.amzn1.x86_64
    php70-process-7.0.21-1.23.amzn1.x86_64
    php70-debuginfo-7.0.21-1.23.amzn1.x86_64
    php70-imap-7.0.21-1.23.amzn1.x86_64
    php70-zip-7.0.21-1.23.amzn1.x86_64
    php70-ldap-7.0.21-1.23.amzn1.x86_64
    php70-json-7.0.21-1.23.amzn1.x86_64
    php70-xmlrpc-7.0.21-1.23.amzn1.x86_64
    php70-tidy-7.0.21-1.23.amzn1.x86_64
    php70-opcache-7.0.21-1.23.amzn1.x86_64
    php70-bcmath-7.0.21-1.23.amzn1.x86_64
    php70-dba-7.0.21-1.23.amzn1.x86_64
    php70-soap-7.0.21-1.23.amzn1.x86_64
    php70-mcrypt-7.0.21-1.23.amzn1.x86_64
    php70-7.0.21-1.23.amzn1.x86_64
    php70-gd-7.0.21-1.23.amzn1.x86_64
    php70-pdo-dblib-7.0.21-1.23.amzn1.x86_64
    php70-gmp-7.0.21-1.23.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2017-867.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.