Skip to content
OpenAdvisories
Medium ALAS2023-2025-873 7 CVEs

Moderate: php8.3 security update (Amazon Linux 2023)

Published Feb 26, 2025 · Updated Dec 30, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-9026: Logs from childrens may be altered NOTE: Fixed in 8.3.12, 8.2.24 NOTE: https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5 NOTE: https://github.com/php/php-src/commit/1f8e16172c7961045c2b0f34ba7613e3f21cdee8 (PHP-8.2.24) CVE-2024-8932: The upstream advisory describes this issue as follows: Uncontrolled long string inputs to ldap_escape on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write. CVE-2024-8929: The upstream advisory describes this issue as follows: By connecting to a fake MySQL server or tampering with network packets and initiating a SQL Query, it is possible to abuse the function static enum_func_status php_mysqlnd_rset_field_read when parsing MySQL fields packets in order to include the rest of the heap content starting from the address of the cursor of the currently read buffer. Using PHP-FPM which stays alive between request, and between two different SQL query requests, as the previous buffer used to store received data from MySQL is not emptied and malloc allocates a memory region which is very near the previous one, one is able to extract the response content of the previous MySQL request from the PHP-FPM worker. CVE-2024-8928: php: Erroneous parsing of multipart form data CVE-2024-8927: cgi.force_redirect configuration is byppassible due to the environment variable collision NOTE: Fixed in 8.3.12, 8.2.24 NOTE: https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp NOTE: https://github.com/php/php-src/commit/48808d98f4fc2a05193cdcc1aedd6c66816450f1 (PHP-8.2.24) CVE-2024-8925: Erroneous parsing of multipart form data NOTE: Fixed in 8.3.12, 8.2.24 NOTE: https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32 NOTE: https://github.com/php/php-src/commit/19b49258d0c5a61398d395d8afde1123e8d161e0 (PHP-8.2.24) CVE-2024-11234: The upstream advisory describes this issue as follows: Configuring a proxy in a stream context might allow for CRLF injection in URIs, resulting in HTTP request smuggling attacks. CVE-2024-11233: The upstream advisory describes this issue as follows: A memory-related vulnerability in PHP's filter handling system, particularly when processing input with convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered through specific sequences of input data, causing PHP to crash. When exploited, it allows an attacker to extract a single byte of data from the heap or cause a DoS.

Fixed packages 60

ReleasePackageFixed in
Amazon Linux · 2023 php8.3 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-bcmath 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-bcmath-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-cli 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-cli-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-common 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-common-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-dba 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-dba-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-dbg 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-dbg-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-debugsource 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-devel 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-embedded 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-embedded-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-enchant 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-enchant-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-ffi 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-ffi-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-fpm 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-fpm-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-gd 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-gd-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-gmp 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-gmp-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-intl 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-intl-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-ldap 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-ldap-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-mbstring 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-mbstring-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-modphp 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-modphp-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-mysqlnd 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-mysqlnd-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-odbc 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-odbc-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-opcache 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-opcache-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-pdo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-pdo-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-pgsql 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-pgsql-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-process 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-process-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-pspell 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-pspell-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-snmp 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-snmp-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-soap 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-soap-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-sodium 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-sodium-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-tidy 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-tidy-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-xml 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-xml-debuginfo 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-zip 0:8.3.16-1.amzn2023.0.1
Amazon Linux · 2023 php8.3-zip-debuginfo 0:8.3.16-1.amzn2023.0.1

Vulnerabilities 7

  • Critical 9.8
    CVE-2024-8932

    OOB access in ldap_escape

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2024-8927

    cgi.force_redirect configuration is bypassable due to the environment variable collision

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be control…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.8
    CVE-2024-8929

    Leak partial content of the heap through heap buffer over-read in mysqlnd

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the …

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 4.8
    CVE-2024-11233

    Single byte overread with convert.quoted-printable-decode filter

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose conte…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 4.8
    CVE-2024-11234

    Configuring a proxy in a stream context might allow for CRLF injection in URIs

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the …

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.3
    CVE-2024-9026

    PHP-FPM logs from children may be altered

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters fr…

    PHP Group PHP php8.1 php Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.1
    CVE-2024-8925

    Erroneous parsing of multipart form data

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control …

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-11233.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-11234.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-8925.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-8927.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-8928.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-8929.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-8932.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-9026.html