Amazon Linux AMI update for php56

Published: 2017-08-17

Risk	High
Patch available	YES
Number of vulnerabilities	5
CVE-ID	CVE-2017-9228 CVE-2017-9229 CVE-2017-9226 CVE-2017-9227 CVE-2017-9224
CWE-ID	CWE-787 CWE-476 CWE-125
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Amazon Linux AMI Operating systems & Components / Operating system
Vendor	Amazon Web Services

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Heap-out-of-bounds write

EUVDB-ID: #VU7348

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-9228

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists in the mbstring due to heap out-of-bounds write in bitset_set_range() during regular expression compilation due to incorrect state transition in parse_char_class(). A remote attacker can trigger out-of-bounds write memory corruption and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected packages.

i686:
    php56-xmlrpc-5.6.31-1.134.amzn1.i686
    php56-recode-5.6.31-1.134.amzn1.i686
    php56-enchant-5.6.31-1.134.amzn1.i686
    php56-intl-5.6.31-1.134.amzn1.i686
    php56-odbc-5.6.31-1.134.amzn1.i686
    php56-bcmath-5.6.31-1.134.amzn1.i686
    php56-mcrypt-5.6.31-1.134.amzn1.i686
    php56-mssql-5.6.31-1.134.amzn1.i686
    php56-cli-5.6.31-1.134.amzn1.i686
    php56-mysqlnd-5.6.31-1.134.amzn1.i686
    php56-dbg-5.6.31-1.134.amzn1.i686
    php56-tidy-5.6.31-1.134.amzn1.i686
    php56-fpm-5.6.31-1.134.amzn1.i686
    php56-gd-5.6.31-1.134.amzn1.i686
    php56-process-5.6.31-1.134.amzn1.i686
    php56-pgsql-5.6.31-1.134.amzn1.i686
    php56-dba-5.6.31-1.134.amzn1.i686
    php56-pdo-5.6.31-1.134.amzn1.i686
    php56-pspell-5.6.31-1.134.amzn1.i686
    php56-common-5.6.31-1.134.amzn1.i686
    php56-gmp-5.6.31-1.134.amzn1.i686
    php56-ldap-5.6.31-1.134.amzn1.i686
    php56-5.6.31-1.134.amzn1.i686
    php56-mbstring-5.6.31-1.134.amzn1.i686
    php56-imap-5.6.31-1.134.amzn1.i686
    php56-opcache-5.6.31-1.134.amzn1.i686
    php56-soap-5.6.31-1.134.amzn1.i686
    php56-xml-5.6.31-1.134.amzn1.i686
    php56-embedded-5.6.31-1.134.amzn1.i686
    php56-snmp-5.6.31-1.134.amzn1.i686
    php56-devel-5.6.31-1.134.amzn1.i686
    php56-debuginfo-5.6.31-1.134.amzn1.i686

src:
    php56-5.6.31-1.134.amzn1.src

x86_64:
    php56-ldap-5.6.31-1.134.amzn1.x86_64
    php56-mcrypt-5.6.31-1.134.amzn1.x86_64
    php56-devel-5.6.31-1.134.amzn1.x86_64
    php56-gd-5.6.31-1.134.amzn1.x86_64
    php56-recode-5.6.31-1.134.amzn1.x86_64
    php56-pdo-5.6.31-1.134.amzn1.x86_64
    php56-tidy-5.6.31-1.134.amzn1.x86_64
    php56-intl-5.6.31-1.134.amzn1.x86_64
    php56-imap-5.6.31-1.134.amzn1.x86_64
    php56-fpm-5.6.31-1.134.amzn1.x86_64
    php56-soap-5.6.31-1.134.amzn1.x86_64
    php56-snmp-5.6.31-1.134.amzn1.x86_64
    php56-pgsql-5.6.31-1.134.amzn1.x86_64
    php56-xmlrpc-5.6.31-1.134.amzn1.x86_64
    php56-process-5.6.31-1.134.amzn1.x86_64
    php56-dbg-5.6.31-1.134.amzn1.x86_64
    php56-embedded-5.6.31-1.134.amzn1.x86_64
    php56-mssql-5.6.31-1.134.amzn1.x86_64
    php56-dba-5.6.31-1.134.amzn1.x86_64
    php56-debuginfo-5.6.31-1.134.amzn1.x86_64
    php56-5.6.31-1.134.amzn1.x86_64
    php56-mysqlnd-5.6.31-1.134.amzn1.x86_64
    php56-gmp-5.6.31-1.134.amzn1.x86_64
    php56-odbc-5.6.31-1.134.amzn1.x86_64
    php56-mbstring-5.6.31-1.134.amzn1.x86_64
    php56-bcmath-5.6.31-1.134.amzn1.x86_64
    php56-pspell-5.6.31-1.134.amzn1.x86_64
    php56-opcache-5.6.31-1.134.amzn1.x86_64
    php56-cli-5.6.31-1.134.amzn1.x86_64
    php56-common-5.6.31-1.134.amzn1.x86_64
    php56-enchant-5.6.31-1.134.amzn1.x86_64
    php56-xml-5.6.31-1.134.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2017-871.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Null pointer dereference

EUVDB-ID: #VU7349

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-9229

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger SIGSEGV in left_adjust_char_head() during regular expression compilation, cause NULL pointer dereference and the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update the affected packages.

i686:
    php56-xmlrpc-5.6.31-1.134.amzn1.i686
    php56-recode-5.6.31-1.134.amzn1.i686
    php56-enchant-5.6.31-1.134.amzn1.i686
    php56-intl-5.6.31-1.134.amzn1.i686
    php56-odbc-5.6.31-1.134.amzn1.i686
    php56-bcmath-5.6.31-1.134.amzn1.i686
    php56-mcrypt-5.6.31-1.134.amzn1.i686
    php56-mssql-5.6.31-1.134.amzn1.i686
    php56-cli-5.6.31-1.134.amzn1.i686
    php56-mysqlnd-5.6.31-1.134.amzn1.i686
    php56-dbg-5.6.31-1.134.amzn1.i686
    php56-tidy-5.6.31-1.134.amzn1.i686
    php56-fpm-5.6.31-1.134.amzn1.i686
    php56-gd-5.6.31-1.134.amzn1.i686
    php56-process-5.6.31-1.134.amzn1.i686
    php56-pgsql-5.6.31-1.134.amzn1.i686
    php56-dba-5.6.31-1.134.amzn1.i686
    php56-pdo-5.6.31-1.134.amzn1.i686
    php56-pspell-5.6.31-1.134.amzn1.i686
    php56-common-5.6.31-1.134.amzn1.i686
    php56-gmp-5.6.31-1.134.amzn1.i686
    php56-ldap-5.6.31-1.134.amzn1.i686
    php56-5.6.31-1.134.amzn1.i686
    php56-mbstring-5.6.31-1.134.amzn1.i686
    php56-imap-5.6.31-1.134.amzn1.i686
    php56-opcache-5.6.31-1.134.amzn1.i686
    php56-soap-5.6.31-1.134.amzn1.i686
    php56-xml-5.6.31-1.134.amzn1.i686
    php56-embedded-5.6.31-1.134.amzn1.i686
    php56-snmp-5.6.31-1.134.amzn1.i686
    php56-devel-5.6.31-1.134.amzn1.i686
    php56-debuginfo-5.6.31-1.134.amzn1.i686

src:
    php56-5.6.31-1.134.amzn1.src

x86_64:
    php56-ldap-5.6.31-1.134.amzn1.x86_64
    php56-mcrypt-5.6.31-1.134.amzn1.x86_64
    php56-devel-5.6.31-1.134.amzn1.x86_64
    php56-gd-5.6.31-1.134.amzn1.x86_64
    php56-recode-5.6.31-1.134.amzn1.x86_64
    php56-pdo-5.6.31-1.134.amzn1.x86_64
    php56-tidy-5.6.31-1.134.amzn1.x86_64
    php56-intl-5.6.31-1.134.amzn1.x86_64
    php56-imap-5.6.31-1.134.amzn1.x86_64
    php56-fpm-5.6.31-1.134.amzn1.x86_64
    php56-soap-5.6.31-1.134.amzn1.x86_64
    php56-snmp-5.6.31-1.134.amzn1.x86_64
    php56-pgsql-5.6.31-1.134.amzn1.x86_64
    php56-xmlrpc-5.6.31-1.134.amzn1.x86_64
    php56-process-5.6.31-1.134.amzn1.x86_64
    php56-dbg-5.6.31-1.134.amzn1.x86_64
    php56-embedded-5.6.31-1.134.amzn1.x86_64
    php56-mssql-5.6.31-1.134.amzn1.x86_64
    php56-dba-5.6.31-1.134.amzn1.x86_64
    php56-debuginfo-5.6.31-1.134.amzn1.x86_64
    php56-5.6.31-1.134.amzn1.x86_64
    php56-mysqlnd-5.6.31-1.134.amzn1.x86_64
    php56-gmp-5.6.31-1.134.amzn1.x86_64
    php56-odbc-5.6.31-1.134.amzn1.x86_64
    php56-mbstring-5.6.31-1.134.amzn1.x86_64
    php56-bcmath-5.6.31-1.134.amzn1.x86_64
    php56-pspell-5.6.31-1.134.amzn1.x86_64
    php56-opcache-5.6.31-1.134.amzn1.x86_64
    php56-cli-5.6.31-1.134.amzn1.x86_64
    php56-common-5.6.31-1.134.amzn1.x86_64
    php56-enchant-5.6.31-1.134.amzn1.x86_64
    php56-xml-5.6.31-1.134.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2017-871.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Heap-out-of-bounds write

EUVDB-ID: #VU7346

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-9226

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists in the mbstring due to heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. A remote attacker can supply a malformed regular expression containing an octal number in the form of '\700', trigger
out-of-bounds write memory corruption and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected packages.

i686:
    php56-xmlrpc-5.6.31-1.134.amzn1.i686
    php56-recode-5.6.31-1.134.amzn1.i686
    php56-enchant-5.6.31-1.134.amzn1.i686
    php56-intl-5.6.31-1.134.amzn1.i686
    php56-odbc-5.6.31-1.134.amzn1.i686
    php56-bcmath-5.6.31-1.134.amzn1.i686
    php56-mcrypt-5.6.31-1.134.amzn1.i686
    php56-mssql-5.6.31-1.134.amzn1.i686
    php56-cli-5.6.31-1.134.amzn1.i686
    php56-mysqlnd-5.6.31-1.134.amzn1.i686
    php56-dbg-5.6.31-1.134.amzn1.i686
    php56-tidy-5.6.31-1.134.amzn1.i686
    php56-fpm-5.6.31-1.134.amzn1.i686
    php56-gd-5.6.31-1.134.amzn1.i686
    php56-process-5.6.31-1.134.amzn1.i686
    php56-pgsql-5.6.31-1.134.amzn1.i686
    php56-dba-5.6.31-1.134.amzn1.i686
    php56-pdo-5.6.31-1.134.amzn1.i686
    php56-pspell-5.6.31-1.134.amzn1.i686
    php56-common-5.6.31-1.134.amzn1.i686
    php56-gmp-5.6.31-1.134.amzn1.i686
    php56-ldap-5.6.31-1.134.amzn1.i686
    php56-5.6.31-1.134.amzn1.i686
    php56-mbstring-5.6.31-1.134.amzn1.i686
    php56-imap-5.6.31-1.134.amzn1.i686
    php56-opcache-5.6.31-1.134.amzn1.i686
    php56-soap-5.6.31-1.134.amzn1.i686
    php56-xml-5.6.31-1.134.amzn1.i686
    php56-embedded-5.6.31-1.134.amzn1.i686
    php56-snmp-5.6.31-1.134.amzn1.i686
    php56-devel-5.6.31-1.134.amzn1.i686
    php56-debuginfo-5.6.31-1.134.amzn1.i686

src:
    php56-5.6.31-1.134.amzn1.src

x86_64:
    php56-ldap-5.6.31-1.134.amzn1.x86_64
    php56-mcrypt-5.6.31-1.134.amzn1.x86_64
    php56-devel-5.6.31-1.134.amzn1.x86_64
    php56-gd-5.6.31-1.134.amzn1.x86_64
    php56-recode-5.6.31-1.134.amzn1.x86_64
    php56-pdo-5.6.31-1.134.amzn1.x86_64
    php56-tidy-5.6.31-1.134.amzn1.x86_64
    php56-intl-5.6.31-1.134.amzn1.x86_64
    php56-imap-5.6.31-1.134.amzn1.x86_64
    php56-fpm-5.6.31-1.134.amzn1.x86_64
    php56-soap-5.6.31-1.134.amzn1.x86_64
    php56-snmp-5.6.31-1.134.amzn1.x86_64
    php56-pgsql-5.6.31-1.134.amzn1.x86_64
    php56-xmlrpc-5.6.31-1.134.amzn1.x86_64
    php56-process-5.6.31-1.134.amzn1.x86_64
    php56-dbg-5.6.31-1.134.amzn1.x86_64
    php56-embedded-5.6.31-1.134.amzn1.x86_64
    php56-mssql-5.6.31-1.134.amzn1.x86_64
    php56-dba-5.6.31-1.134.amzn1.x86_64
    php56-debuginfo-5.6.31-1.134.amzn1.x86_64
    php56-5.6.31-1.134.amzn1.x86_64
    php56-mysqlnd-5.6.31-1.134.amzn1.x86_64
    php56-gmp-5.6.31-1.134.amzn1.x86_64
    php56-odbc-5.6.31-1.134.amzn1.x86_64
    php56-mbstring-5.6.31-1.134.amzn1.x86_64
    php56-bcmath-5.6.31-1.134.amzn1.x86_64
    php56-pspell-5.6.31-1.134.amzn1.x86_64
    php56-opcache-5.6.31-1.134.amzn1.x86_64
    php56-cli-5.6.31-1.134.amzn1.x86_64
    php56-common-5.6.31-1.134.amzn1.x86_64
    php56-enchant-5.6.31-1.134.amzn1.x86_64
    php56-xml-5.6.31-1.134.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2017-871.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds read

EUVDB-ID: #VU7347

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-9227

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger stack out-of-bounds read in mbc_enc_len() during regular expression searching and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Update the affected packages.

i686:
    php56-xmlrpc-5.6.31-1.134.amzn1.i686
    php56-recode-5.6.31-1.134.amzn1.i686
    php56-enchant-5.6.31-1.134.amzn1.i686
    php56-intl-5.6.31-1.134.amzn1.i686
    php56-odbc-5.6.31-1.134.amzn1.i686
    php56-bcmath-5.6.31-1.134.amzn1.i686
    php56-mcrypt-5.6.31-1.134.amzn1.i686
    php56-mssql-5.6.31-1.134.amzn1.i686
    php56-cli-5.6.31-1.134.amzn1.i686
    php56-mysqlnd-5.6.31-1.134.amzn1.i686
    php56-dbg-5.6.31-1.134.amzn1.i686
    php56-tidy-5.6.31-1.134.amzn1.i686
    php56-fpm-5.6.31-1.134.amzn1.i686
    php56-gd-5.6.31-1.134.amzn1.i686
    php56-process-5.6.31-1.134.amzn1.i686
    php56-pgsql-5.6.31-1.134.amzn1.i686
    php56-dba-5.6.31-1.134.amzn1.i686
    php56-pdo-5.6.31-1.134.amzn1.i686
    php56-pspell-5.6.31-1.134.amzn1.i686
    php56-common-5.6.31-1.134.amzn1.i686
    php56-gmp-5.6.31-1.134.amzn1.i686
    php56-ldap-5.6.31-1.134.amzn1.i686
    php56-5.6.31-1.134.amzn1.i686
    php56-mbstring-5.6.31-1.134.amzn1.i686
    php56-imap-5.6.31-1.134.amzn1.i686
    php56-opcache-5.6.31-1.134.amzn1.i686
    php56-soap-5.6.31-1.134.amzn1.i686
    php56-xml-5.6.31-1.134.amzn1.i686
    php56-embedded-5.6.31-1.134.amzn1.i686
    php56-snmp-5.6.31-1.134.amzn1.i686
    php56-devel-5.6.31-1.134.amzn1.i686
    php56-debuginfo-5.6.31-1.134.amzn1.i686

src:
    php56-5.6.31-1.134.amzn1.src

x86_64:
    php56-ldap-5.6.31-1.134.amzn1.x86_64
    php56-mcrypt-5.6.31-1.134.amzn1.x86_64
    php56-devel-5.6.31-1.134.amzn1.x86_64
    php56-gd-5.6.31-1.134.amzn1.x86_64
    php56-recode-5.6.31-1.134.amzn1.x86_64
    php56-pdo-5.6.31-1.134.amzn1.x86_64
    php56-tidy-5.6.31-1.134.amzn1.x86_64
    php56-intl-5.6.31-1.134.amzn1.x86_64
    php56-imap-5.6.31-1.134.amzn1.x86_64
    php56-fpm-5.6.31-1.134.amzn1.x86_64
    php56-soap-5.6.31-1.134.amzn1.x86_64
    php56-snmp-5.6.31-1.134.amzn1.x86_64
    php56-pgsql-5.6.31-1.134.amzn1.x86_64
    php56-xmlrpc-5.6.31-1.134.amzn1.x86_64
    php56-process-5.6.31-1.134.amzn1.x86_64
    php56-dbg-5.6.31-1.134.amzn1.x86_64
    php56-embedded-5.6.31-1.134.amzn1.x86_64
    php56-mssql-5.6.31-1.134.amzn1.x86_64
    php56-dba-5.6.31-1.134.amzn1.x86_64
    php56-debuginfo-5.6.31-1.134.amzn1.x86_64
    php56-5.6.31-1.134.amzn1.x86_64
    php56-mysqlnd-5.6.31-1.134.amzn1.x86_64
    php56-gmp-5.6.31-1.134.amzn1.x86_64
    php56-odbc-5.6.31-1.134.amzn1.x86_64
    php56-mbstring-5.6.31-1.134.amzn1.x86_64
    php56-bcmath-5.6.31-1.134.amzn1.x86_64
    php56-pspell-5.6.31-1.134.amzn1.x86_64
    php56-opcache-5.6.31-1.134.amzn1.x86_64
    php56-cli-5.6.31-1.134.amzn1.x86_64
    php56-common-5.6.31-1.134.amzn1.x86_64
    php56-enchant-5.6.31-1.134.amzn1.x86_64
    php56-xml-5.6.31-1.134.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2017-871.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU7345

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-9224

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the mbstring due to stack out-of-bounds read in match_at() during regular expression searching. A remote attacker can trigger a logical error involving order of validation and access in match_at() and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Update the affected packages.

i686:
    php56-xmlrpc-5.6.31-1.134.amzn1.i686
    php56-recode-5.6.31-1.134.amzn1.i686
    php56-enchant-5.6.31-1.134.amzn1.i686
    php56-intl-5.6.31-1.134.amzn1.i686
    php56-odbc-5.6.31-1.134.amzn1.i686
    php56-bcmath-5.6.31-1.134.amzn1.i686
    php56-mcrypt-5.6.31-1.134.amzn1.i686
    php56-mssql-5.6.31-1.134.amzn1.i686
    php56-cli-5.6.31-1.134.amzn1.i686
    php56-mysqlnd-5.6.31-1.134.amzn1.i686
    php56-dbg-5.6.31-1.134.amzn1.i686
    php56-tidy-5.6.31-1.134.amzn1.i686
    php56-fpm-5.6.31-1.134.amzn1.i686
    php56-gd-5.6.31-1.134.amzn1.i686
    php56-process-5.6.31-1.134.amzn1.i686
    php56-pgsql-5.6.31-1.134.amzn1.i686
    php56-dba-5.6.31-1.134.amzn1.i686
    php56-pdo-5.6.31-1.134.amzn1.i686
    php56-pspell-5.6.31-1.134.amzn1.i686
    php56-common-5.6.31-1.134.amzn1.i686
    php56-gmp-5.6.31-1.134.amzn1.i686
    php56-ldap-5.6.31-1.134.amzn1.i686
    php56-5.6.31-1.134.amzn1.i686
    php56-mbstring-5.6.31-1.134.amzn1.i686
    php56-imap-5.6.31-1.134.amzn1.i686
    php56-opcache-5.6.31-1.134.amzn1.i686
    php56-soap-5.6.31-1.134.amzn1.i686
    php56-xml-5.6.31-1.134.amzn1.i686
    php56-embedded-5.6.31-1.134.amzn1.i686
    php56-snmp-5.6.31-1.134.amzn1.i686
    php56-devel-5.6.31-1.134.amzn1.i686
    php56-debuginfo-5.6.31-1.134.amzn1.i686

src:
    php56-5.6.31-1.134.amzn1.src

x86_64:
    php56-ldap-5.6.31-1.134.amzn1.x86_64
    php56-mcrypt-5.6.31-1.134.amzn1.x86_64
    php56-devel-5.6.31-1.134.amzn1.x86_64
    php56-gd-5.6.31-1.134.amzn1.x86_64
    php56-recode-5.6.31-1.134.amzn1.x86_64
    php56-pdo-5.6.31-1.134.amzn1.x86_64
    php56-tidy-5.6.31-1.134.amzn1.x86_64
    php56-intl-5.6.31-1.134.amzn1.x86_64
    php56-imap-5.6.31-1.134.amzn1.x86_64
    php56-fpm-5.6.31-1.134.amzn1.x86_64
    php56-soap-5.6.31-1.134.amzn1.x86_64
    php56-snmp-5.6.31-1.134.amzn1.x86_64
    php56-pgsql-5.6.31-1.134.amzn1.x86_64
    php56-xmlrpc-5.6.31-1.134.amzn1.x86_64
    php56-process-5.6.31-1.134.amzn1.x86_64
    php56-dbg-5.6.31-1.134.amzn1.x86_64
    php56-embedded-5.6.31-1.134.amzn1.x86_64
    php56-mssql-5.6.31-1.134.amzn1.x86_64
    php56-dba-5.6.31-1.134.amzn1.x86_64
    php56-debuginfo-5.6.31-1.134.amzn1.x86_64
    php56-5.6.31-1.134.amzn1.x86_64
    php56-mysqlnd-5.6.31-1.134.amzn1.x86_64
    php56-gmp-5.6.31-1.134.amzn1.x86_64
    php56-odbc-5.6.31-1.134.amzn1.x86_64
    php56-mbstring-5.6.31-1.134.amzn1.x86_64
    php56-bcmath-5.6.31-1.134.amzn1.x86_64
    php56-pspell-5.6.31-1.134.amzn1.x86_64
    php56-opcache-5.6.31-1.134.amzn1.x86_64
    php56-cli-5.6.31-1.134.amzn1.x86_64
    php56-common-5.6.31-1.134.amzn1.x86_64
    php56-enchant-5.6.31-1.134.amzn1.x86_64
    php56-xml-5.6.31-1.134.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2017-871.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.