Amazon Linux 2 : php (ALAS-2025-2832)

critical Nessus Plugin ID 234513

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The version of php installed on the remote host is prior to 5.4.16-46. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2832 advisory.

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption. (CVE-2017-9226)

A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is possible to force the function to return a single apostrophe if the function is called on user-supplied input without any length restrictions in place. (CVE-2022-31631)

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification. (CVE-2023-0568)

In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE. (CVE-2023-3824)

Erroneous parsing of multipart form data

NOTE: Fixed in 8.3.12, 8.2.24NOTE: https://github.com/php/php- src/security/advisories/GHSA-9pqp-7h25-4f32NOTE: https://github.com/php/php- src/commit/19b49258d0c5a61398d395d8afde1123e8d161e0 (PHP-8.2.24) (CVE-2024-8925)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update php' to update your system.

Plugin Details

Severity: Critical

ID: 234513

File Name: al2_ALAS-2025-2832.nasl

Version: 1.1

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 4/17/2025

Updated: 4/17/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2017-9226

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2023-3824

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:php-snmp, p-cpe:/a:amazon:linux:php-embedded, p-cpe:/a:amazon:linux:php-xmlrpc, p-cpe:/a:amazon:linux:php-pspell, p-cpe:/a:amazon:linux:php-recode, cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:php-ldap, p-cpe:/a:amazon:linux:php-mysqlnd, p-cpe:/a:amazon:linux:php-debuginfo, p-cpe:/a:amazon:linux:php-xml, p-cpe:/a:amazon:linux:php-cli, p-cpe:/a:amazon:linux:php-odbc, p-cpe:/a:amazon:linux:php-enchant, p-cpe:/a:amazon:linux:php-gd, p-cpe:/a:amazon:linux:php-bcmath, p-cpe:/a:amazon:linux:php-fpm, p-cpe:/a:amazon:linux:php-pgsql, p-cpe:/a:amazon:linux:php-devel, p-cpe:/a:amazon:linux:php-process, p-cpe:/a:amazon:linux:php-mbstring, p-cpe:/a:amazon:linux:php-dba, p-cpe:/a:amazon:linux:php-common, p-cpe:/a:amazon:linux:php, p-cpe:/a:amazon:linux:php-soap, p-cpe:/a:amazon:linux:php-intl, p-cpe:/a:amazon:linux:php-pdo

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: No known exploits are available

Patch Publication Date: 4/9/2025

Vulnerability Publication Date: 5/22/2017

Reference Information

CVE: CVE-2017-9226, CVE-2022-31631, CVE-2023-0568, CVE-2023-3824, CVE-2024-8925

IAVA: 2023-A-0016-S, 2023-A-0105-S, 2023-A-0423-S, 2024-A-0609-S

IAVB: 2017-B-0088-S

Detections

Analytics