Lucene search
AmazonALAS-2018-1090HistoryOct 17, 2018 - 9:56 p.m.
Medium: php56, php70, php71, php72
2018-10-1721:56:00
alas.aws.amazon.com
566
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.003 Low
EPSS
Percentile
69.4%
Issue Overview:
The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a “Transfer-Encoding: chunked” request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c. (CVE-2018-17082)
Affected Packages:
php56, php70, php71, php72
Issue Correction:
Run yum update php56 to update your system.
Run yum update php70 to update your system.
Run yum update php71 to update your system.
Run yum update php72 to update your system.
New Packages:
i686:
php56-soap-5.6.38-1.140.amzn1.i686
php56-debuginfo-5.6.38-1.140.amzn1.i686
php56-ldap-5.6.38-1.140.amzn1.i686
php56-intl-5.6.38-1.140.amzn1.i686
php56-opcache-5.6.38-1.140.amzn1.i686
php56-enchant-5.6.38-1.140.amzn1.i686
php56-recode-5.6.38-1.140.amzn1.i686
php56-xmlrpc-5.6.38-1.140.amzn1.i686
php56-mssql-5.6.38-1.140.amzn1.i686
php56-fpm-5.6.38-1.140.amzn1.i686
php56-pgsql-5.6.38-1.140.amzn1.i686
php56-odbc-5.6.38-1.140.amzn1.i686
php56-pspell-5.6.38-1.140.amzn1.i686
php56-cli-5.6.38-1.140.amzn1.i686
php56-common-5.6.38-1.140.amzn1.i686
php56-dba-5.6.38-1.140.amzn1.i686
php56-tidy-5.6.38-1.140.amzn1.i686
php56-5.6.38-1.140.amzn1.i686
php56-mbstring-5.6.38-1.140.amzn1.i686
php56-pdo-5.6.38-1.140.amzn1.i686
php56-mysqlnd-5.6.38-1.140.amzn1.i686
php56-mcrypt-5.6.38-1.140.amzn1.i686
php56-process-5.6.38-1.140.amzn1.i686
php56-embedded-5.6.38-1.140.amzn1.i686
php56-devel-5.6.38-1.140.amzn1.i686
php56-dbg-5.6.38-1.140.amzn1.i686
php56-gd-5.6.38-1.140.amzn1.i686
php56-imap-5.6.38-1.140.amzn1.i686
php56-xml-5.6.38-1.140.amzn1.i686
php56-snmp-5.6.38-1.140.amzn1.i686
php56-bcmath-5.6.38-1.140.amzn1.i686
php56-gmp-5.6.38-1.140.amzn1.i686
php71-debuginfo-7.1.23-1.34.amzn1.i686
php71-pspell-7.1.23-1.34.amzn1.i686
php71-pgsql-7.1.23-1.34.amzn1.i686
php71-dba-7.1.23-1.34.amzn1.i686
php71-snmp-7.1.23-1.34.amzn1.i686
php71-recode-7.1.23-1.34.amzn1.i686
php71-mbstring-7.1.23-1.34.amzn1.i686
php71-dbg-7.1.23-1.34.amzn1.i686
php71-opcache-7.1.23-1.34.amzn1.i686
php71-xmlrpc-7.1.23-1.34.amzn1.i686
php71-intl-7.1.23-1.34.amzn1.i686
php71-devel-7.1.23-1.34.amzn1.i686
php71-imap-7.1.23-1.34.amzn1.i686
php71-common-7.1.23-1.34.amzn1.i686
php71-soap-7.1.23-1.34.amzn1.i686
php71-process-7.1.23-1.34.amzn1.i686
php71-pdo-dblib-7.1.23-1.34.amzn1.i686
php71-bcmath-7.1.23-1.34.amzn1.i686
php71-xml-7.1.23-1.34.amzn1.i686
php71-enchant-7.1.23-1.34.amzn1.i686
php71-odbc-7.1.23-1.34.amzn1.i686
php71-gd-7.1.23-1.34.amzn1.i686
php71-gmp-7.1.23-1.34.amzn1.i686
php71-fpm-7.1.23-1.34.amzn1.i686
php71-pdo-7.1.23-1.34.amzn1.i686
php71-ldap-7.1.23-1.34.amzn1.i686
php71-mysqlnd-7.1.23-1.34.amzn1.i686
php71-json-7.1.23-1.34.amzn1.i686
php71-embedded-7.1.23-1.34.amzn1.i686
php71-mcrypt-7.1.23-1.34.amzn1.i686
php71-tidy-7.1.23-1.34.amzn1.i686
php71-cli-7.1.23-1.34.amzn1.i686
php71-7.1.23-1.34.amzn1.i686
php70-dbg-7.0.32-1.31.amzn1.i686
php70-gmp-7.0.32-1.31.amzn1.i686
php70-common-7.0.32-1.31.amzn1.i686
php70-snmp-7.0.32-1.31.amzn1.i686
php70-mbstring-7.0.32-1.31.amzn1.i686
php70-pdo-dblib-7.0.32-1.31.amzn1.i686
php70-fpm-7.0.32-1.31.amzn1.i686
php70-gd-7.0.32-1.31.amzn1.i686
php70-ldap-7.0.32-1.31.amzn1.i686
php70-xml-7.0.32-1.31.amzn1.i686
php70-odbc-7.0.32-1.31.amzn1.i686
php70-intl-7.0.32-1.31.amzn1.i686
php70-process-7.0.32-1.31.amzn1.i686
php70-enchant-7.0.32-1.31.amzn1.i686
php70-pgsql-7.0.32-1.31.amzn1.i686
php70-dba-7.0.32-1.31.amzn1.i686
php70-bcmath-7.0.32-1.31.amzn1.i686
php70-tidy-7.0.32-1.31.amzn1.i686
php70-cli-7.0.32-1.31.amzn1.i686
php70-pdo-7.0.32-1.31.amzn1.i686
php70-7.0.32-1.31.amzn1.i686
php70-json-7.0.32-1.31.amzn1.i686
php70-mcrypt-7.0.32-1.31.amzn1.i686
php70-mysqlnd-7.0.32-1.31.amzn1.i686
php70-xmlrpc-7.0.32-1.31.amzn1.i686
php70-zip-7.0.32-1.31.amzn1.i686
php70-embedded-7.0.32-1.31.amzn1.i686
php70-recode-7.0.32-1.31.amzn1.i686
php70-opcache-7.0.32-1.31.amzn1.i686
php70-soap-7.0.32-1.31.amzn1.i686
php70-imap-7.0.32-1.31.amzn1.i686
php70-debuginfo-7.0.32-1.31.amzn1.i686
php70-devel-7.0.32-1.31.amzn1.i686
php70-pspell-7.0.32-1.31.amzn1.i686
php72-pdo-dblib-7.2.11-1.6.amzn1.i686
php72-imap-7.2.11-1.6.amzn1.i686
php72-opcache-7.2.11-1.6.amzn1.i686
php72-devel-7.2.11-1.6.amzn1.i686
php72-dbg-7.2.11-1.6.amzn1.i686
php72-mbstring-7.2.11-1.6.amzn1.i686
php72-bcmath-7.2.11-1.6.amzn1.i686
php72-recode-7.2.11-1.6.amzn1.i686
php72-dba-7.2.11-1.6.amzn1.i686
php72-7.2.11-1.6.amzn1.i686
php72-soap-7.2.11-1.6.amzn1.i686
php72-enchant-7.2.11-1.6.amzn1.i686
php72-snmp-7.2.11-1.6.amzn1.i686
php72-debuginfo-7.2.11-1.6.amzn1.i686
php72-gmp-7.2.11-1.6.amzn1.i686
php72-mysqlnd-7.2.11-1.6.amzn1.i686
php72-fpm-7.2.11-1.6.amzn1.i686
php72-embedded-7.2.11-1.6.amzn1.i686
php72-common-7.2.11-1.6.amzn1.i686
php72-process-7.2.11-1.6.amzn1.i686
php72-json-7.2.11-1.6.amzn1.i686
php72-pgsql-7.2.11-1.6.amzn1.i686
php72-pdo-7.2.11-1.6.amzn1.i686
php72-xml-7.2.11-1.6.amzn1.i686
php72-intl-7.2.11-1.6.amzn1.i686
php72-cli-7.2.11-1.6.amzn1.i686
php72-gd-7.2.11-1.6.amzn1.i686
php72-ldap-7.2.11-1.6.amzn1.i686
php72-odbc-7.2.11-1.6.amzn1.i686
php72-pspell-7.2.11-1.6.amzn1.i686
php72-xmlrpc-7.2.11-1.6.amzn1.i686
php72-tidy-7.2.11-1.6.amzn1.i686
src:
php56-5.6.38-1.140.amzn1.src
php71-7.1.23-1.34.amzn1.src
php70-7.0.32-1.31.amzn1.src
php72-7.2.11-1.6.amzn1.src
x86_64:
php56-recode-5.6.38-1.140.amzn1.x86_64
php56-process-5.6.38-1.140.amzn1.x86_64
php56-dba-5.6.38-1.140.amzn1.x86_64
php56-opcache-5.6.38-1.140.amzn1.x86_64
php56-odbc-5.6.38-1.140.amzn1.x86_64
php56-debuginfo-5.6.38-1.140.amzn1.x86_64
php56-mbstring-5.6.38-1.140.amzn1.x86_64
php56-common-5.6.38-1.140.amzn1.x86_64
php56-devel-5.6.38-1.140.amzn1.x86_64
php56-xml-5.6.38-1.140.amzn1.x86_64
php56-dbg-5.6.38-1.140.amzn1.x86_64
php56-bcmath-5.6.38-1.140.amzn1.x86_64
php56-mysqlnd-5.6.38-1.140.amzn1.x86_64
php56-imap-5.6.38-1.140.amzn1.x86_64
php56-pgsql-5.6.38-1.140.amzn1.x86_64
php56-pspell-5.6.38-1.140.amzn1.x86_64
php56-gmp-5.6.38-1.140.amzn1.x86_64
php56-embedded-5.6.38-1.140.amzn1.x86_64
php56-intl-5.6.38-1.140.amzn1.x86_64
php56-tidy-5.6.38-1.140.amzn1.x86_64
php56-5.6.38-1.140.amzn1.x86_64
php56-snmp-5.6.38-1.140.amzn1.x86_64
php56-ldap-5.6.38-1.140.amzn1.x86_64
php56-gd-5.6.38-1.140.amzn1.x86_64
php56-mcrypt-5.6.38-1.140.amzn1.x86_64
php56-mssql-5.6.38-1.140.amzn1.x86_64
php56-fpm-5.6.38-1.140.amzn1.x86_64
php56-cli-5.6.38-1.140.amzn1.x86_64
php56-enchant-5.6.38-1.140.amzn1.x86_64
php56-xmlrpc-5.6.38-1.140.amzn1.x86_64
php56-soap-5.6.38-1.140.amzn1.x86_64
php56-pdo-5.6.38-1.140.amzn1.x86_64
php71-mcrypt-7.1.23-1.34.amzn1.x86_64
php71-devel-7.1.23-1.34.amzn1.x86_64
php71-embedded-7.1.23-1.34.amzn1.x86_64
php71-pdo-dblib-7.1.23-1.34.amzn1.x86_64
php71-odbc-7.1.23-1.34.amzn1.x86_64
php71-process-7.1.23-1.34.amzn1.x86_64
php71-dbg-7.1.23-1.34.amzn1.x86_64
php71-cli-7.1.23-1.34.amzn1.x86_64
php71-pgsql-7.1.23-1.34.amzn1.x86_64
php71-dba-7.1.23-1.34.amzn1.x86_64
php71-pspell-7.1.23-1.34.amzn1.x86_64
php71-recode-7.1.23-1.34.amzn1.x86_64
php71-imap-7.1.23-1.34.amzn1.x86_64
php71-7.1.23-1.34.amzn1.x86_64
php71-bcmath-7.1.23-1.34.amzn1.x86_64
php71-common-7.1.23-1.34.amzn1.x86_64
php71-xmlrpc-7.1.23-1.34.amzn1.x86_64
php71-fpm-7.1.23-1.34.amzn1.x86_64
php71-debuginfo-7.1.23-1.34.amzn1.x86_64
php71-json-7.1.23-1.34.amzn1.x86_64
php71-mbstring-7.1.23-1.34.amzn1.x86_64
php71-pdo-7.1.23-1.34.amzn1.x86_64
php71-mysqlnd-7.1.23-1.34.amzn1.x86_64
php71-ldap-7.1.23-1.34.amzn1.x86_64
php71-tidy-7.1.23-1.34.amzn1.x86_64
php71-soap-7.1.23-1.34.amzn1.x86_64
php71-gmp-7.1.23-1.34.amzn1.x86_64
php71-enchant-7.1.23-1.34.amzn1.x86_64
php71-xml-7.1.23-1.34.amzn1.x86_64
php71-opcache-7.1.23-1.34.amzn1.x86_64
php71-gd-7.1.23-1.34.amzn1.x86_64
php71-intl-7.1.23-1.34.amzn1.x86_64
php71-snmp-7.1.23-1.34.amzn1.x86_64
php70-dba-7.0.32-1.31.amzn1.x86_64
php70-common-7.0.32-1.31.amzn1.x86_64
php70-odbc-7.0.32-1.31.amzn1.x86_64
php70-enchant-7.0.32-1.31.amzn1.x86_64
php70-xmlrpc-7.0.32-1.31.amzn1.x86_64
php70-7.0.32-1.31.amzn1.x86_64
php70-opcache-7.0.32-1.31.amzn1.x86_64
php70-mysqlnd-7.0.32-1.31.amzn1.x86_64
php70-gmp-7.0.32-1.31.amzn1.x86_64
php70-soap-7.0.32-1.31.amzn1.x86_64
php70-bcmath-7.0.32-1.31.amzn1.x86_64
php70-intl-7.0.32-1.31.amzn1.x86_64
php70-debuginfo-7.0.32-1.31.amzn1.x86_64
php70-zip-7.0.32-1.31.amzn1.x86_64
php70-recode-7.0.32-1.31.amzn1.x86_64
php70-embedded-7.0.32-1.31.amzn1.x86_64
php70-mbstring-7.0.32-1.31.amzn1.x86_64
php70-snmp-7.0.32-1.31.amzn1.x86_64
php70-dbg-7.0.32-1.31.amzn1.x86_64
php70-gd-7.0.32-1.31.amzn1.x86_64
php70-tidy-7.0.32-1.31.amzn1.x86_64
php70-pdo-dblib-7.0.32-1.31.amzn1.x86_64
php70-process-7.0.32-1.31.amzn1.x86_64
php70-json-7.0.32-1.31.amzn1.x86_64
php70-imap-7.0.32-1.31.amzn1.x86_64
php70-ldap-7.0.32-1.31.amzn1.x86_64
php70-pdo-7.0.32-1.31.amzn1.x86_64
php70-pspell-7.0.32-1.31.amzn1.x86_64
php70-pgsql-7.0.32-1.31.amzn1.x86_64
php70-devel-7.0.32-1.31.amzn1.x86_64
php70-fpm-7.0.32-1.31.amzn1.x86_64
php70-xml-7.0.32-1.31.amzn1.x86_64
php70-mcrypt-7.0.32-1.31.amzn1.x86_64
php70-cli-7.0.32-1.31.amzn1.x86_64
php72-recode-7.2.11-1.6.amzn1.x86_64
php72-tidy-7.2.11-1.6.amzn1.x86_64
php72-dba-7.2.11-1.6.amzn1.x86_64
php72-json-7.2.11-1.6.amzn1.x86_64
php72-gd-7.2.11-1.6.amzn1.x86_64
php72-devel-7.2.11-1.6.amzn1.x86_64
php72-gmp-7.2.11-1.6.amzn1.x86_64
php72-ldap-7.2.11-1.6.amzn1.x86_64
php72-dbg-7.2.11-1.6.amzn1.x86_64
php72-debuginfo-7.2.11-1.6.amzn1.x86_64
php72-pgsql-7.2.11-1.6.amzn1.x86_64
php72-odbc-7.2.11-1.6.amzn1.x86_64
php72-xml-7.2.11-1.6.amzn1.x86_64
php72-xmlrpc-7.2.11-1.6.amzn1.x86_64
php72-pdo-7.2.11-1.6.amzn1.x86_64
php72-7.2.11-1.6.amzn1.x86_64
php72-snmp-7.2.11-1.6.amzn1.x86_64
php72-bcmath-7.2.11-1.6.amzn1.x86_64
php72-enchant-7.2.11-1.6.amzn1.x86_64
php72-pdo-dblib-7.2.11-1.6.amzn1.x86_64
php72-common-7.2.11-1.6.amzn1.x86_64
php72-embedded-7.2.11-1.6.amzn1.x86_64
php72-imap-7.2.11-1.6.amzn1.x86_64
php72-mysqlnd-7.2.11-1.6.amzn1.x86_64
php72-opcache-7.2.11-1.6.amzn1.x86_64
php72-process-7.2.11-1.6.amzn1.x86_64
php72-intl-7.2.11-1.6.amzn1.x86_64
php72-pspell-7.2.11-1.6.amzn1.x86_64
php72-mbstring-7.2.11-1.6.amzn1.x86_64
php72-fpm-7.2.11-1.6.amzn1.x86_64
php72-soap-7.2.11-1.6.amzn1.x86_64
php72-cli-7.2.11-1.6.amzn1.x86_64
Additional References
Red Hat: CVE-2018-17082
Mitre: CVE-2018-17082
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | i686 | php56-soap | < 5.6.38-1.140.amzn1 | php56-soap-5.6.38-1.140.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php56-debuginfo | < 5.6.38-1.140.amzn1 | php56-debuginfo-5.6.38-1.140.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php56-ldap | < 5.6.38-1.140.amzn1 | php56-ldap-5.6.38-1.140.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php56-intl | < 5.6.38-1.140.amzn1 | php56-intl-5.6.38-1.140.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php56-opcache | < 5.6.38-1.140.amzn1 | php56-opcache-5.6.38-1.140.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php56-enchant | < 5.6.38-1.140.amzn1 | php56-enchant-5.6.38-1.140.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php56-recode | < 5.6.38-1.140.amzn1 | php56-recode-5.6.38-1.140.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php56-xmlrpc | < 5.6.38-1.140.amzn1 | php56-xmlrpc-5.6.38-1.140.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php56-mssql | < 5.6.38-1.140.amzn1 | php56-mssql-5.6.38-1.140.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php56-fpm | < 5.6.38-1.140.amzn1 | php56-fpm-5.6.38-1.140.amzn1.i686.rpm |
Related
suse
suse
Security update for php7 (moderate)
2018-10-06 18:16:05
Security update for php5 (moderate)
2018-10-06 18:11:29
Security update for php7 (moderate)
2018-09-28 12:12:31
nessus
nessus
openSUSE Security Update : php5 (openSUSE-2018-1130)
2018-10-09 00:00:00
Fedora 29 : php (2018-791c3cfe21)
2019-01-03 00:00:00
SUSE SLES12 Security Update : php7 (SUSE-SU-2018:2887-1)
2019-01-02 00:00:00
alpinelinux
alpinelinux
CVE-2018-17082
2018-09-16 15:29:00
hackerone
hackerone
veracode
veracode
Cross-site Scripting (XSS)
2019-08-20 00:10:41
redhatcve
redhatcve
CVE-2018-17082
2019-10-09 11:43:46
fedora
fedora
[SECURITY] Fedora 28 Update: php-7.2.10-1.fc28
2018-09-22 20:52:00
[SECURITY] Fedora 29 Update: php-7.2.10-1.fc29
2018-09-21 05:45:30
[SECURITY] Fedora 27 Update: php-7.1.22-1.fc27
2018-09-23 19:13:35
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2018:3016-1)
2021-06-09 00:00:00
Fedora Update for php FEDORA-2018-b6072889db
2018-09-23 00:00:00
openSUSE: Security Advisory for php7 (openSUSE-SU-2018:3062-1)
2018-10-26 00:00:00
f5
f5
K89095152 : PHP vulnerability CVE-2018-17082
2018-11-12 00:00:00
debian
debian
[SECURITY] [DLA 1509-1] php5 security update
2018-09-20 03:42:19
[SECURITY] [DSA 4353-1] php7.0 security update
2018-12-10 21:40:39
osv
osv
php5 - security update
2018-09-19 00:00:00
CVE-2018-17082
2018-09-16 15:29:00
php7.0 - security update
2018-12-10 00:00:00
cve
cve
CVE-2018-17082
2018-09-16 15:29:00
debiancve
debiancve
CVE-2018-17082
2018-09-16 15:29:00
ibm
ibm
prion
prion
Design/Logic Flaw
2018-09-16 15:29:00
ubuntucve
ubuntucve
CVE-2018-17082
2018-09-16 00:00:00
checkpoint_advisories
checkpoint_advisories
gentoo
gentoo
PHP: Multiple vulnerabilities
2018-12-02 00:00:00
redhat
redhat
rosalinux
rosalinux
Advisory ROSA-SA-2021-1950
2021-07-02 17:57:45
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.003 Low
EPSS
Percentile
69.4%
Related for ALAS-2018-1090