Skip to content
OpenAdvisories
High ALAS2-2025-2832 6 CVEs

Important: php security update (Amazon Linux 2)

Published Apr 9, 2025 · Updated Dec 30, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-8928: php: Erroneous parsing of multipart form data CVE-2024-8925: Erroneous parsing of multipart form data NOTE: Fixed in 8.3.12, 8.2.24 NOTE: https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32 NOTE: https://github.com/php/php-src/commit/19b49258d0c5a61398d395d8afde1123e8d161e0 (PHP-8.2.24) CVE-2023-3824: In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE. CVE-2023-0568: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification. CVE-2022-31631: A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is possible to force the function to return a single apostrophe if the function is called on user-supplied input without any length restrictions in place. CVE-2019-19203: An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read. CVE-2017-9226: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.

Fixed packages 25

ReleasePackageFixed in
Amazon Linux · 2 php 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-bcmath 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-cli 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-common 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-dba 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-debuginfo 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-devel 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-embedded 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-enchant 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-fpm 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-gd 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-intl 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-ldap 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-mbstring 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-mysqlnd 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-odbc 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-pdo 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-pgsql 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-process 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-pspell 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-recode 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-snmp 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-soap 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-xml 0:5.4.16-46.amzn2.0.6
Amazon Linux · 2 php-xmlrpc 0:5.4.16-46.amzn2.0.6

Vulnerabilities 6

  • Critical 9.4
    CVE-2023-3824 Public exploit EPSS 22%

    Buffer overflow and overread in phar_dir_read()

    In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2022-31631

    PDO::quote() may return unquoted string

    In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • High 7.5
    CVE-2023-0568

    Array overrun in common path resolve code

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffe…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Low 3.1
    CVE-2024-8925

    Erroneous parsing of multipart form data

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control …

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
  • Unscored —
    CVE-2017-9226

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through …

    php5 php7.0 php7 php5 Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-19203 Public exploit

    An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UCh…

    libonig libonig Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-9226.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-19203.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-31631.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-0568.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-3824.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-8925.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-8928.html