ALAS-2016-753


Amazon Linux AMI Security Advisory: ALAS-2016-753
Advisory Release Date: 2016-10-12 17:00 Pacific
Severity: Medium

Issue Overview:

ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an unserialize call that references a partially constructed object (CVE-2016-7411 ).

ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, which allows remote MySQL servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted field metadata (CVE-2016-7412 ).

Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field element, leading to mishandling in a wddx_deserialize call (CVE-2016-7413 ).

The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive, related to ext/phar/util.c and ext/phar/zip.c (CVE-2016-7414 ).

ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to the Locale class in the ICU library, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a MessageFormatter::formatMessage call with a long first argument (CVE-2016-7416 ).

ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data (CVE-2016-7417 ).

The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service (invalid pointer access and out-of-bounds read) or possibly have unspecified other impact via an incorrect boolean element in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call (CVE-2016-7418 ).


Affected Packages:

php56


Issue Correction:
Run yum update php56 to update your system.

New Packages:
i686:
    php56-tidy-5.6.26-1.128.amzn1.i686
    php56-bcmath-5.6.26-1.128.amzn1.i686
    php56-fpm-5.6.26-1.128.amzn1.i686
    php56-mysqlnd-5.6.26-1.128.amzn1.i686
    php56-intl-5.6.26-1.128.amzn1.i686
    php56-cli-5.6.26-1.128.amzn1.i686
    php56-mssql-5.6.26-1.128.amzn1.i686
    php56-enchant-5.6.26-1.128.amzn1.i686
    php56-dba-5.6.26-1.128.amzn1.i686
    php56-soap-5.6.26-1.128.amzn1.i686
    php56-common-5.6.26-1.128.amzn1.i686
    php56-mcrypt-5.6.26-1.128.amzn1.i686
    php56-gmp-5.6.26-1.128.amzn1.i686
    php56-5.6.26-1.128.amzn1.i686
    php56-process-5.6.26-1.128.amzn1.i686
    php56-pspell-5.6.26-1.128.amzn1.i686
    php56-mbstring-5.6.26-1.128.amzn1.i686
    php56-pgsql-5.6.26-1.128.amzn1.i686
    php56-debuginfo-5.6.26-1.128.amzn1.i686
    php56-dbg-5.6.26-1.128.amzn1.i686
    php56-imap-5.6.26-1.128.amzn1.i686
    php56-odbc-5.6.26-1.128.amzn1.i686
    php56-snmp-5.6.26-1.128.amzn1.i686
    php56-ldap-5.6.26-1.128.amzn1.i686
    php56-embedded-5.6.26-1.128.amzn1.i686
    php56-xmlrpc-5.6.26-1.128.amzn1.i686
    php56-devel-5.6.26-1.128.amzn1.i686
    php56-pdo-5.6.26-1.128.amzn1.i686
    php56-gd-5.6.26-1.128.amzn1.i686
    php56-opcache-5.6.26-1.128.amzn1.i686
    php56-recode-5.6.26-1.128.amzn1.i686
    php56-xml-5.6.26-1.128.amzn1.i686

src:
    php56-5.6.26-1.128.amzn1.src

x86_64:
    php56-process-5.6.26-1.128.amzn1.x86_64
    php56-dba-5.6.26-1.128.amzn1.x86_64
    php56-odbc-5.6.26-1.128.amzn1.x86_64
    php56-intl-5.6.26-1.128.amzn1.x86_64
    php56-pgsql-5.6.26-1.128.amzn1.x86_64
    php56-recode-5.6.26-1.128.amzn1.x86_64
    php56-gmp-5.6.26-1.128.amzn1.x86_64
    php56-enchant-5.6.26-1.128.amzn1.x86_64
    php56-xml-5.6.26-1.128.amzn1.x86_64
    php56-ldap-5.6.26-1.128.amzn1.x86_64
    php56-bcmath-5.6.26-1.128.amzn1.x86_64
    php56-devel-5.6.26-1.128.amzn1.x86_64
    php56-mbstring-5.6.26-1.128.amzn1.x86_64
    php56-common-5.6.26-1.128.amzn1.x86_64
    php56-soap-5.6.26-1.128.amzn1.x86_64
    php56-5.6.26-1.128.amzn1.x86_64
    php56-dbg-5.6.26-1.128.amzn1.x86_64
    php56-pspell-5.6.26-1.128.amzn1.x86_64
    php56-debuginfo-5.6.26-1.128.amzn1.x86_64
    php56-snmp-5.6.26-1.128.amzn1.x86_64
    php56-xmlrpc-5.6.26-1.128.amzn1.x86_64
    php56-mssql-5.6.26-1.128.amzn1.x86_64
    php56-cli-5.6.26-1.128.amzn1.x86_64
    php56-pdo-5.6.26-1.128.amzn1.x86_64
    php56-opcache-5.6.26-1.128.amzn1.x86_64
    php56-gd-5.6.26-1.128.amzn1.x86_64
    php56-fpm-5.6.26-1.128.amzn1.x86_64
    php56-mysqlnd-5.6.26-1.128.amzn1.x86_64
    php56-embedded-5.6.26-1.128.amzn1.x86_64
    php56-tidy-5.6.26-1.128.amzn1.x86_64
    php56-imap-5.6.26-1.128.amzn1.x86_64
    php56-mcrypt-5.6.26-1.128.amzn1.x86_64