Lucene search
AmazonALAS-2016-698HistoryMay 03, 2016 - 10:30 a.m.
Important: php56, php55
2016-05-0310:30:00
alas.aws.amazon.com
21
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.493 Medium
EPSS
Percentile
97.5%
Issue Overview:
The following security-related issues were resolved:
Buffer over-write in finfo_open with malformed magic file (CVE-2015-8865)
Signedness vulnerability causing heap overflow in libgd (CVE-2016-3074)
Integer overflow in php_raw_url_encode (CVE-2016-4070)
Format string vulnerability in php_snmp_error() (CVE-2016-4071)
Invalid memory write in phar on filename containing \\0 inside name (CVE-2016-4072)
Negative size parameter in memcpy (CVE-2016-4073)
Affected Packages:
php56, php55
Issue Correction:
Run yum update php56 to update your system.
Run yum update php55 to update your system.
New Packages:
i686:
php55-mbstring-5.5.35-1.114.amzn1.i686
php55-intl-5.5.35-1.114.amzn1.i686
php55-tidy-5.5.35-1.114.amzn1.i686
php55-pdo-5.5.35-1.114.amzn1.i686
php55-enchant-5.5.35-1.114.amzn1.i686
php55-mcrypt-5.5.35-1.114.amzn1.i686
php55-xmlrpc-5.5.35-1.114.amzn1.i686
php55-pspell-5.5.35-1.114.amzn1.i686
php55-snmp-5.5.35-1.114.amzn1.i686
php55-debuginfo-5.5.35-1.114.amzn1.i686
php55-xml-5.5.35-1.114.amzn1.i686
php55-embedded-5.5.35-1.114.amzn1.i686
php55-gd-5.5.35-1.114.amzn1.i686
php55-5.5.35-1.114.amzn1.i686
php55-gmp-5.5.35-1.114.amzn1.i686
php55-recode-5.5.35-1.114.amzn1.i686
php55-cli-5.5.35-1.114.amzn1.i686
php55-devel-5.5.35-1.114.amzn1.i686
php55-common-5.5.35-1.114.amzn1.i686
php55-mssql-5.5.35-1.114.amzn1.i686
php55-dba-5.5.35-1.114.amzn1.i686
php55-bcmath-5.5.35-1.114.amzn1.i686
php55-pgsql-5.5.35-1.114.amzn1.i686
php55-fpm-5.5.35-1.114.amzn1.i686
php55-opcache-5.5.35-1.114.amzn1.i686
php55-imap-5.5.35-1.114.amzn1.i686
php55-mysqlnd-5.5.35-1.114.amzn1.i686
php55-odbc-5.5.35-1.114.amzn1.i686
php55-process-5.5.35-1.114.amzn1.i686
php55-soap-5.5.35-1.114.amzn1.i686
php55-ldap-5.5.35-1.114.amzn1.i686
php56-cli-5.6.21-1.124.amzn1.i686
php56-embedded-5.6.21-1.124.amzn1.i686
php56-ldap-5.6.21-1.124.amzn1.i686
php56-common-5.6.21-1.124.amzn1.i686
php56-intl-5.6.21-1.124.amzn1.i686
php56-mcrypt-5.6.21-1.124.amzn1.i686
php56-mysqlnd-5.6.21-1.124.amzn1.i686
php56-xml-5.6.21-1.124.amzn1.i686
php56-debuginfo-5.6.21-1.124.amzn1.i686
php56-pgsql-5.6.21-1.124.amzn1.i686
php56-fpm-5.6.21-1.124.amzn1.i686
php56-bcmath-5.6.21-1.124.amzn1.i686
php56-xmlrpc-5.6.21-1.124.amzn1.i686
php56-dba-5.6.21-1.124.amzn1.i686
php56-devel-5.6.21-1.124.amzn1.i686
php56-pdo-5.6.21-1.124.amzn1.i686
php56-snmp-5.6.21-1.124.amzn1.i686
php56-opcache-5.6.21-1.124.amzn1.i686
php56-mssql-5.6.21-1.124.amzn1.i686
php56-recode-5.6.21-1.124.amzn1.i686
php56-odbc-5.6.21-1.124.amzn1.i686
php56-gmp-5.6.21-1.124.amzn1.i686
php56-gd-5.6.21-1.124.amzn1.i686
php56-pspell-5.6.21-1.124.amzn1.i686
php56-5.6.21-1.124.amzn1.i686
php56-soap-5.6.21-1.124.amzn1.i686
php56-mbstring-5.6.21-1.124.amzn1.i686
php56-process-5.6.21-1.124.amzn1.i686
php56-tidy-5.6.21-1.124.amzn1.i686
php56-imap-5.6.21-1.124.amzn1.i686
php56-dbg-5.6.21-1.124.amzn1.i686
php56-enchant-5.6.21-1.124.amzn1.i686
src:
php55-5.5.35-1.114.amzn1.src
php56-5.6.21-1.124.amzn1.src
x86_64:
php55-devel-5.5.35-1.114.amzn1.x86_64
php55-gd-5.5.35-1.114.amzn1.x86_64
php55-enchant-5.5.35-1.114.amzn1.x86_64
php55-mysqlnd-5.5.35-1.114.amzn1.x86_64
php55-intl-5.5.35-1.114.amzn1.x86_64
php55-imap-5.5.35-1.114.amzn1.x86_64
php55-pgsql-5.5.35-1.114.amzn1.x86_64
php55-5.5.35-1.114.amzn1.x86_64
php55-bcmath-5.5.35-1.114.amzn1.x86_64
php55-dba-5.5.35-1.114.amzn1.x86_64
php55-mssql-5.5.35-1.114.amzn1.x86_64
php55-process-5.5.35-1.114.amzn1.x86_64
php55-xml-5.5.35-1.114.amzn1.x86_64
php55-pspell-5.5.35-1.114.amzn1.x86_64
php55-recode-5.5.35-1.114.amzn1.x86_64
php55-pdo-5.5.35-1.114.amzn1.x86_64
php55-xmlrpc-5.5.35-1.114.amzn1.x86_64
php55-snmp-5.5.35-1.114.amzn1.x86_64
php55-fpm-5.5.35-1.114.amzn1.x86_64
php55-ldap-5.5.35-1.114.amzn1.x86_64
php55-gmp-5.5.35-1.114.amzn1.x86_64
php55-embedded-5.5.35-1.114.amzn1.x86_64
php55-mcrypt-5.5.35-1.114.amzn1.x86_64
php55-odbc-5.5.35-1.114.amzn1.x86_64
php55-common-5.5.35-1.114.amzn1.x86_64
php55-tidy-5.5.35-1.114.amzn1.x86_64
php55-mbstring-5.5.35-1.114.amzn1.x86_64
php55-cli-5.5.35-1.114.amzn1.x86_64
php55-opcache-5.5.35-1.114.amzn1.x86_64
php55-debuginfo-5.5.35-1.114.amzn1.x86_64
php55-soap-5.5.35-1.114.amzn1.x86_64
php56-opcache-5.6.21-1.124.amzn1.x86_64
php56-5.6.21-1.124.amzn1.x86_64
php56-debuginfo-5.6.21-1.124.amzn1.x86_64
php56-mcrypt-5.6.21-1.124.amzn1.x86_64
php56-fpm-5.6.21-1.124.amzn1.x86_64
php56-bcmath-5.6.21-1.124.amzn1.x86_64
php56-ldap-5.6.21-1.124.amzn1.x86_64
php56-xmlrpc-5.6.21-1.124.amzn1.x86_64
php56-intl-5.6.21-1.124.amzn1.x86_64
php56-dba-5.6.21-1.124.amzn1.x86_64
php56-embedded-5.6.21-1.124.amzn1.x86_64
php56-common-5.6.21-1.124.amzn1.x86_64
php56-mysqlnd-5.6.21-1.124.amzn1.x86_64
php56-tidy-5.6.21-1.124.amzn1.x86_64
php56-gmp-5.6.21-1.124.amzn1.x86_64
php56-recode-5.6.21-1.124.amzn1.x86_64
php56-enchant-5.6.21-1.124.amzn1.x86_64
php56-process-5.6.21-1.124.amzn1.x86_64
php56-xml-5.6.21-1.124.amzn1.x86_64
php56-devel-5.6.21-1.124.amzn1.x86_64
php56-gd-5.6.21-1.124.amzn1.x86_64
php56-cli-5.6.21-1.124.amzn1.x86_64
php56-soap-5.6.21-1.124.amzn1.x86_64
php56-odbc-5.6.21-1.124.amzn1.x86_64
php56-snmp-5.6.21-1.124.amzn1.x86_64
php56-mssql-5.6.21-1.124.amzn1.x86_64
php56-imap-5.6.21-1.124.amzn1.x86_64
php56-pspell-5.6.21-1.124.amzn1.x86_64
php56-mbstring-5.6.21-1.124.amzn1.x86_64
php56-pdo-5.6.21-1.124.amzn1.x86_64
php56-pgsql-5.6.21-1.124.amzn1.x86_64
php56-dbg-5.6.21-1.124.amzn1.x86_64
Additional References
Red Hat: CVE-2015-8865, CVE-2016-3074, CVE-2016-4070, CVE-2016-4071, CVE-2016-4072, CVE-2016-4073
Mitre: CVE-2015-8865, CVE-2016-3074, CVE-2016-4070, CVE-2016-4071, CVE-2016-4072, CVE-2016-4073
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | i686 | php55-mbstring | < 5.5.35-1.114.amzn1 | php55-mbstring-5.5.35-1.114.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-intl | < 5.5.35-1.114.amzn1 | php55-intl-5.5.35-1.114.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-tidy | < 5.5.35-1.114.amzn1 | php55-tidy-5.5.35-1.114.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-pdo | < 5.5.35-1.114.amzn1 | php55-pdo-5.5.35-1.114.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-enchant | < 5.5.35-1.114.amzn1 | php55-enchant-5.5.35-1.114.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-mcrypt | < 5.5.35-1.114.amzn1 | php55-mcrypt-5.5.35-1.114.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-xmlrpc | < 5.5.35-1.114.amzn1 | php55-xmlrpc-5.5.35-1.114.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-pspell | < 5.5.35-1.114.amzn1 | php55-pspell-5.5.35-1.114.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-snmp | < 5.5.35-1.114.amzn1 | php55-snmp-5.5.35-1.114.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-debuginfo | < 5.5.35-1.114.amzn1 | php55-debuginfo-5.5.35-1.114.amzn1.i686.rpm |
Related
nessus
nessus
Amazon Linux AMI : php56 / php55 (ALAS-2016-698)
2016-05-04 00:00:00
PHP 5.6.x < 5.6.20 Multiple Vulnerabilities
2016-04-06 00:00:00
PHP 5.5.x < 5.5.34 Multiple Vulnerabilities
2016-04-06 00:00:00
openvas
openvas
Amazon Linux: Security Advisory (ALAS-2016-698)
2016-05-09 00:00:00
Debian Security Advisory DSA 3560-1 (php5 - security update)
2016-04-27 00:00:00
PHP Multiple Vulnerabilities - 01 - Jul16 (Linux)
2016-07-14 00:00:00
debian
debian
[SECURITY] [DSA 3560-1] php5 security update
2016-04-27 20:06:49
[SECURITY] [DSA 3560-1] php5 security update
2016-04-27 20:06:49
[SECURITY] [DLA 460-1] file security update
2016-05-07 14:23:47
suse
suse
Security update for php5 (important)
2016-05-11 14:07:47
Security update for php5 (important)
2016-05-20 15:09:02
Security update for php5 (important)
2016-05-11 18:07:54
osv
osv
file - security update
2016-05-07 00:00:00
php5 - security update
2016-05-31 00:00:00
CVE-2016-3074
2016-04-26 14:59:00
hackerone
hackerone
ubuntucve
ubuntucve
f5
f5
K54924436 : PHP vulnerability CVE-2015-8865
2016-06-10 00:00:00
SOL54924436 - PHP vulnerability CVE-2015-8865
2016-06-10 00:00:00
SOL51484039 - PHP 'snmp.c' remote format string vulnerability CVE-2016-4071
2016-06-08 00:00:00
cve
cve
prion
prion
Buffer overflow
2016-05-20 10:59:00
Format string
2016-05-20 11:00:00
Integer overflow
2016-05-20 11:00:00
debiancve
debiancve
ubuntu
ubuntu
PHP vulnerabilities
2016-05-24 00:00:00
file vulnerabilities
2018-06-28 00:00:00
file vulnerabilities
2018-06-14 00:00:00
veracode
veracode
Arbitrary Code Execution
2019-05-02 06:02:18
Denial Of Service (DoS)
2019-05-02 06:02:18
Arbitrary Code Execution
2019-05-02 06:02:18
seebug
seebug
libgd 2.1.1 - Signedness Heap Overflow
2017-01-18 00:00:00
freebsd
freebsd
php -- multiple vulnerabilities
2016-04-28 00:00:00
archlinux
archlinux
gd: arbitrary code execution
2016-05-06 00:00:00
checkpoint_advisories
checkpoint_advisories
GD Library libgd gd_gd2.c Heap Buffer Overflow (CVE-2016-3074)
2016-05-29 00:00:00
zdt
zdt
PHP LibGD Heap Buffer Overflow Exploit
2017-01-17 00:00:00
libgd 2.1.1 - Signedness Heap Overflow
2016-04-26 00:00:00
exploitpack
exploitpack
libgd 2.1.1 - Signedness Heap Overflow
2016-04-26 00:00:00
threatpost
threatpost
Juniper Issues Security Alert Tied to Routers and Switches
2017-08-10 13:56:38
fedora
fedora
[SECURITY] Fedora 22 Update: gd-2.1.1-3.fc22
2016-05-16 14:58:01
[SECURITY] Fedora 23 Update: gd-2.1.1-5.fc23
2016-04-30 00:27:18
[SECURITY] Fedora 24 Update: gd-2.1.1-7.fc24
2016-05-07 12:28:06
packetstorm
packetstorm
libgd 2.1.1 Signedness
2016-04-21 00:00:00
PHP LibGD Heap Buffer Overflow
2017-01-17 00:00:00
alpinelinux
alpinelinux
CVE-2016-3074
2016-04-26 14:59:00
mageia
mageia
Updated libgd packages fix CVE-2016-3074
2016-04-26 21:02:43
slackware
slackware
[slackware-security] php
2016-04-29 21:57:42
ibm
ibm
exploitdb
exploitdb
libgd 2.1.1 - Signedness Heap Overflow
2016-04-26 00:00:00
gentoo
gentoo
GD: Multiple vulnerabilities
2016-07-16 00:00:00
file: Multiple vulnerabilities
2017-01-17 00:00:00
PHP: Multiple vulnerabilities
2016-11-30 00:00:00
cloudfoundry
cloudfoundry
USN-3686-1: file vulnerabilities | Cloud Foundry
2018-06-20 00:00:00
USN-2987-1 GD library vulnerabilities | Cloud Foundry
2016-06-13 00:00:00
redhat
redhat
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.493 Medium
EPSS
Percentile
97.5%
Related for ALAS-2016-698