Lucene search
AmazonALAS-2014-435HistoryOct 28, 2014 - 5:10 p.m.
Important: php55
2014-10-2817:10:00
alas.aws.amazon.com
15
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.937 High
EPSS
Percentile
99.1%
Issue Overview:
An out of bounds read flaw was found in the way the xmlrpc extension parsed dates in the ISO 8601 format. A specially crafted XML-RPC request or response could possibly cause a PHP application to crash. (CVE-2014-3668)
An integer overflow flaw was found in the way custom objects were unserialized. Specially crafted input processed by the unserialize() function could cause a PHP application to crash. (CVE-2014-3669)
A buffer overflow flaw was found in the Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_thumbnail() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3670)
Affected Packages:
php55
Issue Correction:
Run yum update php55 to update your system.
New Packages:
i686:
php55-pdo-5.5.18-1.92.amzn1.i686
php55-embedded-5.5.18-1.92.amzn1.i686
php55-mcrypt-5.5.18-1.92.amzn1.i686
php55-ldap-5.5.18-1.92.amzn1.i686
php55-common-5.5.18-1.92.amzn1.i686
php55-process-5.5.18-1.92.amzn1.i686
php55-devel-5.5.18-1.92.amzn1.i686
php55-bcmath-5.5.18-1.92.amzn1.i686
php55-xmlrpc-5.5.18-1.92.amzn1.i686
php55-recode-5.5.18-1.92.amzn1.i686
php55-pgsql-5.5.18-1.92.amzn1.i686
php55-imap-5.5.18-1.92.amzn1.i686
php55-fpm-5.5.18-1.92.amzn1.i686
php55-cli-5.5.18-1.92.amzn1.i686
php55-mysqlnd-5.5.18-1.92.amzn1.i686
php55-5.5.18-1.92.amzn1.i686
php55-gd-5.5.18-1.92.amzn1.i686
php55-mssql-5.5.18-1.92.amzn1.i686
php55-odbc-5.5.18-1.92.amzn1.i686
php55-pspell-5.5.18-1.92.amzn1.i686
php55-xml-5.5.18-1.92.amzn1.i686
php55-gmp-5.5.18-1.92.amzn1.i686
php55-snmp-5.5.18-1.92.amzn1.i686
php55-mbstring-5.5.18-1.92.amzn1.i686
php55-tidy-5.5.18-1.92.amzn1.i686
php55-opcache-5.5.18-1.92.amzn1.i686
php55-debuginfo-5.5.18-1.92.amzn1.i686
php55-intl-5.5.18-1.92.amzn1.i686
php55-soap-5.5.18-1.92.amzn1.i686
php55-dba-5.5.18-1.92.amzn1.i686
php55-enchant-5.5.18-1.92.amzn1.i686
src:
php55-5.5.18-1.92.amzn1.src
x86_64:
php55-5.5.18-1.92.amzn1.x86_64
php55-soap-5.5.18-1.92.amzn1.x86_64
php55-enchant-5.5.18-1.92.amzn1.x86_64
php55-pspell-5.5.18-1.92.amzn1.x86_64
php55-ldap-5.5.18-1.92.amzn1.x86_64
php55-debuginfo-5.5.18-1.92.amzn1.x86_64
php55-xml-5.5.18-1.92.amzn1.x86_64
php55-opcache-5.5.18-1.92.amzn1.x86_64
php55-cli-5.5.18-1.92.amzn1.x86_64
php55-mbstring-5.5.18-1.92.amzn1.x86_64
php55-gmp-5.5.18-1.92.amzn1.x86_64
php55-process-5.5.18-1.92.amzn1.x86_64
php55-pgsql-5.5.18-1.92.amzn1.x86_64
php55-intl-5.5.18-1.92.amzn1.x86_64
php55-fpm-5.5.18-1.92.amzn1.x86_64
php55-embedded-5.5.18-1.92.amzn1.x86_64
php55-devel-5.5.18-1.92.amzn1.x86_64
php55-tidy-5.5.18-1.92.amzn1.x86_64
php55-gd-5.5.18-1.92.amzn1.x86_64
php55-recode-5.5.18-1.92.amzn1.x86_64
php55-xmlrpc-5.5.18-1.92.amzn1.x86_64
php55-bcmath-5.5.18-1.92.amzn1.x86_64
php55-dba-5.5.18-1.92.amzn1.x86_64
php55-mysqlnd-5.5.18-1.92.amzn1.x86_64
php55-odbc-5.5.18-1.92.amzn1.x86_64
php55-mssql-5.5.18-1.92.amzn1.x86_64
php55-imap-5.5.18-1.92.amzn1.x86_64
php55-common-5.5.18-1.92.amzn1.x86_64
php55-snmp-5.5.18-1.92.amzn1.x86_64
php55-mcrypt-5.5.18-1.92.amzn1.x86_64
php55-pdo-5.5.18-1.92.amzn1.x86_64
Additional References
Red Hat: CVE-2014-3668, CVE-2014-3669, CVE-2014-3670
Mitre: CVE-2014-3668, CVE-2014-3669, CVE-2014-3670
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | i686 | php55-pdo | < 5.5.18-1.92.amzn1 | php55-pdo-5.5.18-1.92.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-embedded | < 5.5.18-1.92.amzn1 | php55-embedded-5.5.18-1.92.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-mcrypt | < 5.5.18-1.92.amzn1 | php55-mcrypt-5.5.18-1.92.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-ldap | < 5.5.18-1.92.amzn1 | php55-ldap-5.5.18-1.92.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-common | < 5.5.18-1.92.amzn1 | php55-common-5.5.18-1.92.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-process | < 5.5.18-1.92.amzn1 | php55-process-5.5.18-1.92.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-devel | < 5.5.18-1.92.amzn1 | php55-devel-5.5.18-1.92.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-bcmath | < 5.5.18-1.92.amzn1 | php55-bcmath-5.5.18-1.92.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-xmlrpc | < 5.5.18-1.92.amzn1 | php55-xmlrpc-5.5.18-1.92.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-recode | < 5.5.18-1.92.amzn1 | php55-recode-5.5.18-1.92.amzn1.i686.rpm |
Related
threatpost
threatpost
PHP Patches Buffer Overflow Vulnerabilities
2014-10-22 13:33:23
securityvulns
securityvulns
PHP memory corruption
2014-11-03 00:00:00
[USN-2391-1] php5 vulnerabilities
2014-11-03 00:00:00
[ MDVSA-2014:202 ] php
2014-10-27 00:00:00
openvas
openvas
Amazon Linux: Security Advisory (ALAS-2014-435)
2015-09-08 00:00:00
Slackware: Security Advisory (SSA:2014-307-03)
2022-04-21 00:00:00
SUSE: Security Advisory (SUSE-SU-2014:1441-1)
2021-06-09 00:00:00
nessus
nessus
Slackware 14.0 / 14.1 / current : php (SSA:2014-307-03)
2014-11-04 00:00:00
openSUSE Security Update : php5 (openSUSE-SU-2014:1377-1)
2014-11-11 00:00:00
PHP 5.6.x < 5.6.2 Multiple Vulnerabilities
2019-01-09 00:00:00
gentoo
gentoo
PHP: Multiple vulnerabilities
2014-11-09 00:00:00
ibm
ibm
f5
f5
amazon
amazon
Important: php54
2014-10-28 17:09:00
slackware
slackware
[slackware-security] php
2014-11-04 01:25:39
debian
debian
[SECURITY] [DSA 3064-1] php5 security update
2014-11-04 16:08:18
[SECURITY] [DSA 3064-1] php5 security update
2014-11-04 16:08:18
[SECURITY] [DLA 94-1] php5 security update
2014-11-25 21:53:34
redhat
redhat
(RHSA-2014:1768) Important: php53 security update
2014-10-30 00:00:00
(RHSA-2014:1767) Important: php security update
2014-10-30 00:00:00
(RHSA-2015:0021) Important: php security update
2015-01-08 00:00:00
oraclelinux
oraclelinux
php53 security update
2014-10-30 00:00:00
php security update
2014-10-30 00:00:00
php security update
2014-11-06 00:00:00
ubuntu
ubuntu
php5 vulnerabilities
2014-10-30 00:00:00
centos
centos
php53 security update
2014-10-31 14:37:09
php security update
2014-10-31 13:14:51
php security update
2014-11-06 18:30:07
osv
osv
php5 - security update
2014-11-25 00:00:00
php5 - security update
2014-11-04 00:00:00
mageia
mageia
Updated php packages fix security vulnerabilities
2014-10-28 14:33:36
veracode
veracode
Memory Corruption And Code Execution
2019-05-02 05:13:12
Denial Of Service (DoS)
2019-01-15 09:02:38
Arbitrary Code Execution
2019-05-02 05:04:21
prion
prion
Buffer overflow
2014-10-29 10:55:00
Memory corruption
2014-10-29 10:55:00
Integer overflow
2014-10-29 10:55:00
hackerone
hackerone
ubuntucve
ubuntucve
cve
cve
fedora
fedora
[SECURITY] Fedora 21 Update: php-5.6.2-1.fc21
2014-11-01 16:41:03
[SECURITY] Fedora 20 Update: php-5.5.18-1.fc20
2014-10-23 06:23:25
[SECURITY] Fedora 19 Update: php-5.5.18-1.fc19
2014-10-28 06:35:04
checkpoint_advisories
checkpoint_advisories
PHP exif Extension exif_ifd_make_value Thumbnail Heap Buffer Overflow (CVE-2014-3670)
2014-12-02 00:00:00
PHP Core unserialize Function Integer Overflow (CVE-2014-3669)
2014-11-25 00:00:00
suse
suse
Security update for php53 (important)
2016-06-21 13:08:17
kitploit
kitploit
Radamsa - A General-Purpose Fuzzer
2024-03-25 11:30:00
rosalinux
rosalinux
Advisory ROSA-SA-2021-1950
2021-07-02 17:57:45
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.937 High
EPSS
Percentile
99.1%
Related for ALAS-2014-435