Lucene search
AmazonALAS-2018-946HistoryFeb 07, 2018 - 5:10 p.m.
Medium: php56, php70, php71
2018-02-0717:10:00
alas.aws.amazon.com
54
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
7.3
Confidence
Low
EPSS
0.62
Percentile
97.8%
Issue Overview:
Reflected XSS in .phar 404 page
An issue was discovered in PHP; there is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file. (CVE-2018-5712)
Denial of Service (DoS) via infinite loop in libgd gdImageCreateFromGifCtx function in ext/gd/libgd/gd_gif_in.c
The gd_gif_in.c file in the GD Graphics Library (aka libgd), as used in PHP has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx. (CVE-2018-5711)
Affected Packages:
php56, php70, php71
Issue Correction:
Run yum update php56 to update your system.
Run yum update php70 to update your system.
Run yum update php71 to update your system.
New Packages:
i686:
php71-soap-7.1.13-1.30.amzn1.i686
php71-intl-7.1.13-1.30.amzn1.i686
php71-ldap-7.1.13-1.30.amzn1.i686
php71-7.1.13-1.30.amzn1.i686
php71-pspell-7.1.13-1.30.amzn1.i686
php71-opcache-7.1.13-1.30.amzn1.i686
php71-gmp-7.1.13-1.30.amzn1.i686
php71-snmp-7.1.13-1.30.amzn1.i686
php71-odbc-7.1.13-1.30.amzn1.i686
php71-embedded-7.1.13-1.30.amzn1.i686
php71-pgsql-7.1.13-1.30.amzn1.i686
php71-tidy-7.1.13-1.30.amzn1.i686
php71-xmlrpc-7.1.13-1.30.amzn1.i686
php71-imap-7.1.13-1.30.amzn1.i686
php71-process-7.1.13-1.30.amzn1.i686
php71-bcmath-7.1.13-1.30.amzn1.i686
php71-debuginfo-7.1.13-1.30.amzn1.i686
php71-json-7.1.13-1.30.amzn1.i686
php71-pdo-dblib-7.1.13-1.30.amzn1.i686
php71-dba-7.1.13-1.30.amzn1.i686
php71-dbg-7.1.13-1.30.amzn1.i686
php71-mbstring-7.1.13-1.30.amzn1.i686
php71-fpm-7.1.13-1.30.amzn1.i686
php71-mysqlnd-7.1.13-1.30.amzn1.i686
php71-mcrypt-7.1.13-1.30.amzn1.i686
php71-cli-7.1.13-1.30.amzn1.i686
php71-common-7.1.13-1.30.amzn1.i686
php71-recode-7.1.13-1.30.amzn1.i686
php71-devel-7.1.13-1.30.amzn1.i686
php71-enchant-7.1.13-1.30.amzn1.i686
php71-gd-7.1.13-1.30.amzn1.i686
php71-pdo-7.1.13-1.30.amzn1.i686
php71-xml-7.1.13-1.30.amzn1.i686
php70-mysqlnd-7.0.27-1.27.amzn1.i686
php70-snmp-7.0.27-1.27.amzn1.i686
php70-pdo-7.0.27-1.27.amzn1.i686
php70-bcmath-7.0.27-1.27.amzn1.i686
php70-gmp-7.0.27-1.27.amzn1.i686
php70-dbg-7.0.27-1.27.amzn1.i686
php70-soap-7.0.27-1.27.amzn1.i686
php70-embedded-7.0.27-1.27.amzn1.i686
php70-pgsql-7.0.27-1.27.amzn1.i686
php70-ldap-7.0.27-1.27.amzn1.i686
php70-recode-7.0.27-1.27.amzn1.i686
php70-devel-7.0.27-1.27.amzn1.i686
php70-mbstring-7.0.27-1.27.amzn1.i686
php70-odbc-7.0.27-1.27.amzn1.i686
php70-opcache-7.0.27-1.27.amzn1.i686
php70-enchant-7.0.27-1.27.amzn1.i686
php70-common-7.0.27-1.27.amzn1.i686
php70-imap-7.0.27-1.27.amzn1.i686
php70-mcrypt-7.0.27-1.27.amzn1.i686
php70-tidy-7.0.27-1.27.amzn1.i686
php70-intl-7.0.27-1.27.amzn1.i686
php70-gd-7.0.27-1.27.amzn1.i686
php70-xml-7.0.27-1.27.amzn1.i686
php70-xmlrpc-7.0.27-1.27.amzn1.i686
php70-zip-7.0.27-1.27.amzn1.i686
php70-cli-7.0.27-1.27.amzn1.i686
php70-fpm-7.0.27-1.27.amzn1.i686
php70-process-7.0.27-1.27.amzn1.i686
php70-dba-7.0.27-1.27.amzn1.i686
php70-7.0.27-1.27.amzn1.i686
php70-pspell-7.0.27-1.27.amzn1.i686
php70-json-7.0.27-1.27.amzn1.i686
php70-pdo-dblib-7.0.27-1.27.amzn1.i686
php70-debuginfo-7.0.27-1.27.amzn1.i686
php56-mysqlnd-5.6.33-1.136.amzn1.i686
php56-tidy-5.6.33-1.136.amzn1.i686
php56-5.6.33-1.136.amzn1.i686
php56-soap-5.6.33-1.136.amzn1.i686
php56-mssql-5.6.33-1.136.amzn1.i686
php56-pspell-5.6.33-1.136.amzn1.i686
php56-enchant-5.6.33-1.136.amzn1.i686
php56-xmlrpc-5.6.33-1.136.amzn1.i686
php56-odbc-5.6.33-1.136.amzn1.i686
php56-process-5.6.33-1.136.amzn1.i686
php56-imap-5.6.33-1.136.amzn1.i686
php56-recode-5.6.33-1.136.amzn1.i686
php56-pgsql-5.6.33-1.136.amzn1.i686
php56-gmp-5.6.33-1.136.amzn1.i686
php56-cli-5.6.33-1.136.amzn1.i686
php56-snmp-5.6.33-1.136.amzn1.i686
php56-dbg-5.6.33-1.136.amzn1.i686
php56-embedded-5.6.33-1.136.amzn1.i686
php56-debuginfo-5.6.33-1.136.amzn1.i686
php56-intl-5.6.33-1.136.amzn1.i686
php56-bcmath-5.6.33-1.136.amzn1.i686
php56-xml-5.6.33-1.136.amzn1.i686
php56-ldap-5.6.33-1.136.amzn1.i686
php56-gd-5.6.33-1.136.amzn1.i686
php56-fpm-5.6.33-1.136.amzn1.i686
php56-pdo-5.6.33-1.136.amzn1.i686
php56-devel-5.6.33-1.136.amzn1.i686
php56-common-5.6.33-1.136.amzn1.i686
php56-opcache-5.6.33-1.136.amzn1.i686
php56-dba-5.6.33-1.136.amzn1.i686
php56-mbstring-5.6.33-1.136.amzn1.i686
php56-mcrypt-5.6.33-1.136.amzn1.i686
src:
php71-7.1.13-1.30.amzn1.src
php70-7.0.27-1.27.amzn1.src
php56-5.6.33-1.136.amzn1.src
x86_64:
php71-debuginfo-7.1.13-1.30.amzn1.x86_64
php71-gd-7.1.13-1.30.amzn1.x86_64
php71-odbc-7.1.13-1.30.amzn1.x86_64
php71-process-7.1.13-1.30.amzn1.x86_64
php71-imap-7.1.13-1.30.amzn1.x86_64
php71-mbstring-7.1.13-1.30.amzn1.x86_64
php71-mcrypt-7.1.13-1.30.amzn1.x86_64
php71-gmp-7.1.13-1.30.amzn1.x86_64
php71-soap-7.1.13-1.30.amzn1.x86_64
php71-ldap-7.1.13-1.30.amzn1.x86_64
php71-snmp-7.1.13-1.30.amzn1.x86_64
php71-enchant-7.1.13-1.30.amzn1.x86_64
php71-tidy-7.1.13-1.30.amzn1.x86_64
php71-pdo-dblib-7.1.13-1.30.amzn1.x86_64
php71-json-7.1.13-1.30.amzn1.x86_64
php71-embedded-7.1.13-1.30.amzn1.x86_64
php71-devel-7.1.13-1.30.amzn1.x86_64
php71-7.1.13-1.30.amzn1.x86_64
php71-pspell-7.1.13-1.30.amzn1.x86_64
php71-common-7.1.13-1.30.amzn1.x86_64
php71-recode-7.1.13-1.30.amzn1.x86_64
php71-xmlrpc-7.1.13-1.30.amzn1.x86_64
php71-pgsql-7.1.13-1.30.amzn1.x86_64
php71-cli-7.1.13-1.30.amzn1.x86_64
php71-dbg-7.1.13-1.30.amzn1.x86_64
php71-xml-7.1.13-1.30.amzn1.x86_64
php71-opcache-7.1.13-1.30.amzn1.x86_64
php71-fpm-7.1.13-1.30.amzn1.x86_64
php71-mysqlnd-7.1.13-1.30.amzn1.x86_64
php71-dba-7.1.13-1.30.amzn1.x86_64
php71-intl-7.1.13-1.30.amzn1.x86_64
php71-pdo-7.1.13-1.30.amzn1.x86_64
php71-bcmath-7.1.13-1.30.amzn1.x86_64
php70-debuginfo-7.0.27-1.27.amzn1.x86_64
php70-dba-7.0.27-1.27.amzn1.x86_64
php70-mcrypt-7.0.27-1.27.amzn1.x86_64
php70-7.0.27-1.27.amzn1.x86_64
php70-tidy-7.0.27-1.27.amzn1.x86_64
php70-bcmath-7.0.27-1.27.amzn1.x86_64
php70-opcache-7.0.27-1.27.amzn1.x86_64
php70-fpm-7.0.27-1.27.amzn1.x86_64
php70-pdo-7.0.27-1.27.amzn1.x86_64
php70-mysqlnd-7.0.27-1.27.amzn1.x86_64
php70-dbg-7.0.27-1.27.amzn1.x86_64
php70-gmp-7.0.27-1.27.amzn1.x86_64
php70-process-7.0.27-1.27.amzn1.x86_64
php70-imap-7.0.27-1.27.amzn1.x86_64
php70-snmp-7.0.27-1.27.amzn1.x86_64
php70-cli-7.0.27-1.27.amzn1.x86_64
php70-ldap-7.0.27-1.27.amzn1.x86_64
php70-enchant-7.0.27-1.27.amzn1.x86_64
php70-intl-7.0.27-1.27.amzn1.x86_64
php70-odbc-7.0.27-1.27.amzn1.x86_64
php70-json-7.0.27-1.27.amzn1.x86_64
php70-devel-7.0.27-1.27.amzn1.x86_64
php70-recode-7.0.27-1.27.amzn1.x86_64
php70-pspell-7.0.27-1.27.amzn1.x86_64
php70-common-7.0.27-1.27.amzn1.x86_64
php70-soap-7.0.27-1.27.amzn1.x86_64
php70-xml-7.0.27-1.27.amzn1.x86_64
php70-xmlrpc-7.0.27-1.27.amzn1.x86_64
php70-pdo-dblib-7.0.27-1.27.amzn1.x86_64
php70-pgsql-7.0.27-1.27.amzn1.x86_64
php70-gd-7.0.27-1.27.amzn1.x86_64
php70-zip-7.0.27-1.27.amzn1.x86_64
php70-embedded-7.0.27-1.27.amzn1.x86_64
php70-mbstring-7.0.27-1.27.amzn1.x86_64
php56-intl-5.6.33-1.136.amzn1.x86_64
php56-cli-5.6.33-1.136.amzn1.x86_64
php56-pspell-5.6.33-1.136.amzn1.x86_64
php56-gmp-5.6.33-1.136.amzn1.x86_64
php56-soap-5.6.33-1.136.amzn1.x86_64
php56-devel-5.6.33-1.136.amzn1.x86_64
php56-process-5.6.33-1.136.amzn1.x86_64
php56-enchant-5.6.33-1.136.amzn1.x86_64
php56-xml-5.6.33-1.136.amzn1.x86_64
php56-mssql-5.6.33-1.136.amzn1.x86_64
php56-snmp-5.6.33-1.136.amzn1.x86_64
php56-pdo-5.6.33-1.136.amzn1.x86_64
php56-debuginfo-5.6.33-1.136.amzn1.x86_64
php56-xmlrpc-5.6.33-1.136.amzn1.x86_64
php56-mcrypt-5.6.33-1.136.amzn1.x86_64
php56-dba-5.6.33-1.136.amzn1.x86_64
php56-bcmath-5.6.33-1.136.amzn1.x86_64
php56-opcache-5.6.33-1.136.amzn1.x86_64
php56-dbg-5.6.33-1.136.amzn1.x86_64
php56-pgsql-5.6.33-1.136.amzn1.x86_64
php56-common-5.6.33-1.136.amzn1.x86_64
php56-ldap-5.6.33-1.136.amzn1.x86_64
php56-odbc-5.6.33-1.136.amzn1.x86_64
php56-5.6.33-1.136.amzn1.x86_64
php56-recode-5.6.33-1.136.amzn1.x86_64
php56-mbstring-5.6.33-1.136.amzn1.x86_64
php56-fpm-5.6.33-1.136.amzn1.x86_64
php56-imap-5.6.33-1.136.amzn1.x86_64
php56-gd-5.6.33-1.136.amzn1.x86_64
php56-embedded-5.6.33-1.136.amzn1.x86_64
php56-mysqlnd-5.6.33-1.136.amzn1.x86_64
php56-tidy-5.6.33-1.136.amzn1.x86_64
Additional References
Red Hat: CVE-2018-5711, CVE-2018-5712
Mitre: CVE-2018-5711, CVE-2018-5712
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | i686 | php71-soap | < 7.1.13-1.30.amzn1 | php71-soap-7.1.13-1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php71-intl | < 7.1.13-1.30.amzn1 | php71-intl-7.1.13-1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php71-ldap | < 7.1.13-1.30.amzn1 | php71-ldap-7.1.13-1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php71 | < 7.1.13-1.30.amzn1 | php71-7.1.13-1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php71-pspell | < 7.1.13-1.30.amzn1 | php71-pspell-7.1.13-1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php71-opcache | < 7.1.13-1.30.amzn1 | php71-opcache-7.1.13-1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php71-gmp | < 7.1.13-1.30.amzn1 | php71-gmp-7.1.13-1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php71-snmp | < 7.1.13-1.30.amzn1 | php71-snmp-7.1.13-1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php71-odbc | < 7.1.13-1.30.amzn1 | php71-odbc-7.1.13-1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php71-embedded | < 7.1.13-1.30.amzn1 | php71-embedded-7.1.13-1.30.amzn1.i686.rpm |
Related
nessus
nessus
openSUSE Security Update : php7 (openSUSE-2018-119)
2018-02-01 00:00:00
openSUSE Security Update : php5 (openSUSE-2018-99)
2018-01-29 00:00:00
SUSE SLES12 Security Update : php7 (SUSE-SU-2018:0308-1)
2019-01-02 00:00:00
openvas
openvas
PHP 'PHAR' Error Page Reflected XSS And DoS Vulnerabilities - Linux
2018-01-19 00:00:00
PHP 'PHAR' Error Page Reflected XSS And DoS Vulnerabilities - Windows
2018-01-19 00:00:00
Slackware: Security Advisory (SSA:2018-034-01)
2022-04-21 00:00:00
slackware
slackware
[slackware-security] php
2018-02-04 07:16:29
[slackware-security] php
2018-05-17 04:21:18
[slackware-security] gd
2020-03-23 20:45:50
osv
osv
libgd2 - security update
2018-01-19 00:00:00
CVE-2018-5711
2018-01-16 09:29:00
php5 - security update
2018-01-20 00:00:00
ubuntucve
ubuntucve
prion
prion
Integer overflow
2018-01-16 09:29:00
Cross site scripting
2018-01-16 09:29:00
Design/Logic Flaw
2018-04-29 21:29:00
cve
cve
veracode
veracode
Denial Of Service (DoS) Through Infinite Loop
2019-05-16 03:00:00
Cross-site Scripting (XSS)
2019-05-16 03:00:00
Cross-site Scripting (XSS)
2019-08-20 00:10:41
fedora
fedora
[SECURITY] Fedora 27 Update: gd-2.2.5-3.fc27
2018-03-28 23:51:17
[SECURITY] Fedora 28 Update: gd-2.2.5-3.fc28
2018-04-04 15:54:13
[SECURITY] Fedora 26 Update: gd-2.2.5-2.fc26
2018-04-04 16:48:02
hackerone
hackerone
Internet Bug Bounty: Potential infinite loop in gdImageCreateFromGifCtx!
2018-01-17 17:27:50
seebug
seebug
PHP CVE-2018-5711 - Hanging Websites by a Harmful GIF
2018-02-02 00:00:00
debian
debian
[SECURITY] [DLA 1248-1] libgd2 security update
2018-01-19 04:58:18
[SECURITY] [DLA 1251-1] php5 security update
2018-01-20 15:25:36
[SECURITY] [DLA 1373-1] php5 security update
2018-05-09 19:09:30
debiancve
debiancve
redhatcve
redhatcve
alpinelinux
alpinelinux
f5
f5
K43223005 : PHP vulnerability CVE-2018-5711
2018-02-06 00:00:00
K10204425 : PHP vulnerability CVE-2018-5712
2018-01-24 00:00:00
K61561040 : PHP vulnerability CVE-2018-10547
2018-05-07 00:00:00
cvelist
cvelist
nvd
nvd
suse
suse
Security update for php53 (important)
2018-03-26 15:08:04
cloudfoundry
cloudfoundry
USN-3755-1: GD vulnerabilities | Cloud Foundry
2018-09-11 00:00:00
ubuntu
ubuntu
GD vulnerabilities
2018-08-27 00:00:00
PHP vulnerabilities
2018-05-15 00:00:00
PHP vulnerabilities
2018-02-12 00:00:00
mageia
mageia
Updated libgd packages fix security vulnerabilities
2018-09-02 22:07:30
photon
photon
Moderate Photon OS Security Update - PHSA-2023-3.0-0612
2023-07-13 00:00:00
redhat
redhat
(RHSA-2020:1112) Moderate: php security update
2020-03-31 09:20:14
gentoo
gentoo
GD: Multiple vulnerabilities
2019-03-28 00:00:00
centos
centos
php security update
2020-04-08 19:04:38
ibm
ibm
amazon
amazon
Medium: php56, php70, php71
2018-05-10 18:23:00
oraclelinux
oraclelinux
php security update
2020-04-06 00:00:00
cloudlinux
cloudlinux
Fix of 227 CVE
2020-10-15 12:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2021-1950
2021-07-02 17:57:45
oracle
oracle
Oracle Critical Patch Update Advisory - April 2020
2020-04-14 00:00:00
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
7.3
Confidence
Low
EPSS
0.62
Percentile
97.8%
Related for ALAS-2018-946