Skip to content
OpenAdvisories
High ALAS2-2024-2520 1 CVE

Important: php security update (Amazon Linux 2)

Published Apr 11, 2024 · Updated Apr 15, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-9227: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.

Fixed packages 25

ReleasePackageFixed in
Amazon Linux · 2 php 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-bcmath 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-cli 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-common 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-dba 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-debuginfo 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-devel 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-embedded 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-enchant 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-fpm 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-gd 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-intl 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-ldap 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-mbstring 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-mysqlnd 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-odbc 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-pdo 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-pgsql 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-process 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-pspell 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-recode 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-snmp 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-soap 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-xml 0:5.4.16-46.amzn2.0.5
Amazon Linux · 2 php-xmlrpc 0:5.4.16-46.amzn2.0.5

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-9227.html