Skip to content
OpenAdvisories
High ALAS2023-2023-081 6 CVEs

Important: php8.1 security update (Amazon Linux 2023)

Published Feb 17, 2023 · Updated Feb 22, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-37454: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. CVE-2022-31631: A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is possible to force the function to return a single apostrophe if the function is called on user-supplied input without any length restrictions in place. CVE-2022-31630: In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information. CVE-2022-31629: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a or cookie by PHP applications. CVE-2022-31628: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress quines gzip files, resulting in an infinite loop. CVE-2022-31627: A vulnerability was found in php. This issue occurs due to memory corruption in the finfo_buffer() function and a bad patch of the libmagic library. This flaw allows an attacker or malicious actor to execute a heap buffer overflow successfully, causing a memory crash.

Fixed packages 50

ReleasePackageFixed in
Amazon Linux · 2023 php8.1 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-bcmath 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-bcmath-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-cli 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-cli-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-common 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-common-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-dba 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-dba-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-dbg 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-dbg-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-debugsource 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-devel 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-embedded 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-embedded-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-enchant 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-enchant-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-ffi 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-ffi-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-fpm 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-fpm-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-gd 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-gd-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-gmp 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-gmp-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-intl 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-intl-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-ldap 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-ldap-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-mbstring 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-mbstring-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-mysqlnd 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-mysqlnd-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-odbc 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-odbc-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-opcache 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-opcache-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-pdo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-pdo-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-pgsql 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-pgsql-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-process 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-process-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-soap 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-soap-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-tidy 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-tidy-debuginfo 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-xml 0:8.1.14-1.amzn2023.0.2
Amazon Linux · 2023 php8.1-xml-debuginfo 0:8.1.14-1.amzn2023.0.2

Vulnerabilities 6

  • Critical 9.8
    CVE-2022-37454

    Buffer overflow in sponge queue functions

    The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

    php7.2 python3.6 python3.8 python3.7 Debian Ubuntu Azure Linux Alpine PyPI RubyGems
  • Critical 9.1
    CVE-2022-31631

    PDO::quote() may return unquoted string

    In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • High 7.7
    CVE-2022-31627

    Heap buffer overflow in finfo_buffer

    In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.

    PHP Group PHP php8.1 Ubuntu
  • Medium 6.5
    CVE-2022-31629 Public exploit EPSS 50%

    $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2022-31630 Public exploit

    OOB read due to insufficient input validation in imageloadfont()

    In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer wi…

    PHP Group PHP php7 php7.4 Debian Ubuntu Alpine
  • Low 2.3
    CVE-2022-31628

    phar wrapper can occur dos when using quine gzip file

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-31627.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-31628.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-31629.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-31630.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-31631.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-37454.html