Amazon Linux 2 Security Advisory: ALAS2-2025-2832
Advisory Released Date: 2025-04-16
Advisory Updated Date: 2025-04-23
FAQs regarding Amazon Linux ALAS/CVE Severity
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption. (CVE-2017-9226)
An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read. (CVE-2019-19203)
A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is possible to force the function to return a single apostrophe if the function is called on user-supplied input without any length restrictions in place. (CVE-2022-31631)
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification. (CVE-2023-0568)
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE. (CVE-2023-3824)
Erroneous parsing of multipart form data
NOTE: Fixed in 8.3.12, 8.2.24
NOTE: https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32
NOTE: https://github.com/php/php-src/commit/19b49258d0c5a61398d395d8afde1123e8d161e0 (PHP-8.2.24) (CVE-2024-8925)
Affected Packages:
php
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update php to update your system.
aarch64:
php-5.4.16-46.amzn2.0.6.aarch64
php-cli-5.4.16-46.amzn2.0.6.aarch64
php-fpm-5.4.16-46.amzn2.0.6.aarch64
php-common-5.4.16-46.amzn2.0.6.aarch64
php-devel-5.4.16-46.amzn2.0.6.aarch64
php-ldap-5.4.16-46.amzn2.0.6.aarch64
php-pdo-5.4.16-46.amzn2.0.6.aarch64
php-mysqlnd-5.4.16-46.amzn2.0.6.aarch64
php-pgsql-5.4.16-46.amzn2.0.6.aarch64
php-process-5.4.16-46.amzn2.0.6.aarch64
php-odbc-5.4.16-46.amzn2.0.6.aarch64
php-soap-5.4.16-46.amzn2.0.6.aarch64
php-snmp-5.4.16-46.amzn2.0.6.aarch64
php-xml-5.4.16-46.amzn2.0.6.aarch64
php-xmlrpc-5.4.16-46.amzn2.0.6.aarch64
php-mbstring-5.4.16-46.amzn2.0.6.aarch64
php-gd-5.4.16-46.amzn2.0.6.aarch64
php-bcmath-5.4.16-46.amzn2.0.6.aarch64
php-dba-5.4.16-46.amzn2.0.6.aarch64
php-embedded-5.4.16-46.amzn2.0.6.aarch64
php-pspell-5.4.16-46.amzn2.0.6.aarch64
php-recode-5.4.16-46.amzn2.0.6.aarch64
php-intl-5.4.16-46.amzn2.0.6.aarch64
php-enchant-5.4.16-46.amzn2.0.6.aarch64
php-debuginfo-5.4.16-46.amzn2.0.6.aarch64
i686:
php-5.4.16-46.amzn2.0.6.i686
php-cli-5.4.16-46.amzn2.0.6.i686
php-fpm-5.4.16-46.amzn2.0.6.i686
php-common-5.4.16-46.amzn2.0.6.i686
php-devel-5.4.16-46.amzn2.0.6.i686
php-ldap-5.4.16-46.amzn2.0.6.i686
php-pdo-5.4.16-46.amzn2.0.6.i686
php-mysqlnd-5.4.16-46.amzn2.0.6.i686
php-pgsql-5.4.16-46.amzn2.0.6.i686
php-process-5.4.16-46.amzn2.0.6.i686
php-odbc-5.4.16-46.amzn2.0.6.i686
php-soap-5.4.16-46.amzn2.0.6.i686
php-snmp-5.4.16-46.amzn2.0.6.i686
php-xml-5.4.16-46.amzn2.0.6.i686
php-xmlrpc-5.4.16-46.amzn2.0.6.i686
php-mbstring-5.4.16-46.amzn2.0.6.i686
php-gd-5.4.16-46.amzn2.0.6.i686
php-bcmath-5.4.16-46.amzn2.0.6.i686
php-dba-5.4.16-46.amzn2.0.6.i686
php-embedded-5.4.16-46.amzn2.0.6.i686
php-pspell-5.4.16-46.amzn2.0.6.i686
php-recode-5.4.16-46.amzn2.0.6.i686
php-intl-5.4.16-46.amzn2.0.6.i686
php-enchant-5.4.16-46.amzn2.0.6.i686
php-debuginfo-5.4.16-46.amzn2.0.6.i686
src:
php-5.4.16-46.amzn2.0.6.src
x86_64:
php-5.4.16-46.amzn2.0.6.x86_64
php-cli-5.4.16-46.amzn2.0.6.x86_64
php-fpm-5.4.16-46.amzn2.0.6.x86_64
php-common-5.4.16-46.amzn2.0.6.x86_64
php-devel-5.4.16-46.amzn2.0.6.x86_64
php-ldap-5.4.16-46.amzn2.0.6.x86_64
php-pdo-5.4.16-46.amzn2.0.6.x86_64
php-mysqlnd-5.4.16-46.amzn2.0.6.x86_64
php-pgsql-5.4.16-46.amzn2.0.6.x86_64
php-process-5.4.16-46.amzn2.0.6.x86_64
php-odbc-5.4.16-46.amzn2.0.6.x86_64
php-soap-5.4.16-46.amzn2.0.6.x86_64
php-snmp-5.4.16-46.amzn2.0.6.x86_64
php-xml-5.4.16-46.amzn2.0.6.x86_64
php-xmlrpc-5.4.16-46.amzn2.0.6.x86_64
php-mbstring-5.4.16-46.amzn2.0.6.x86_64
php-gd-5.4.16-46.amzn2.0.6.x86_64
php-bcmath-5.4.16-46.amzn2.0.6.x86_64
php-dba-5.4.16-46.amzn2.0.6.x86_64
php-embedded-5.4.16-46.amzn2.0.6.x86_64
php-pspell-5.4.16-46.amzn2.0.6.x86_64
php-recode-5.4.16-46.amzn2.0.6.x86_64
php-intl-5.4.16-46.amzn2.0.6.x86_64
php-enchant-5.4.16-46.amzn2.0.6.x86_64
php-debuginfo-5.4.16-46.amzn2.0.6.x86_64
2025-04-23: CVE-2019-19203 was added to this advisory.