ALAS-2024-1921

Related Vulnerabilities: CVE-2019-18218  

cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write). (CVE-2019-18218)

ALAS-2024-1921


Amazon Linux 1 Security Advisory: ALAS-2024-1921
Advisory Release Date: 2024-02-14 20:03 Pacific
Advisory Updated Date: 2024-02-19 19:12 Pacific
Severity: Important

Issue Overview:

cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write). (CVE-2019-18218)


Affected Packages:

php72


Issue Correction:
Run yum update php72 to update your system.

New Packages:
i686:
    php72-debuginfo-7.2.26-1.19.amzn1.i686
    php72-pspell-7.2.26-1.19.amzn1.i686
    php72-pdo-dblib-7.2.26-1.19.amzn1.i686
    php72-gd-7.2.26-1.19.amzn1.i686
    php72-common-7.2.26-1.19.amzn1.i686
    php72-enchant-7.2.26-1.19.amzn1.i686
    php72-tidy-7.2.26-1.19.amzn1.i686
    php72-embedded-7.2.26-1.19.amzn1.i686
    php72-soap-7.2.26-1.19.amzn1.i686
    php72-xmlrpc-7.2.26-1.19.amzn1.i686
    php72-snmp-7.2.26-1.19.amzn1.i686
    php72-pdo-7.2.26-1.19.amzn1.i686
    php72-opcache-7.2.26-1.19.amzn1.i686
    php72-dba-7.2.26-1.19.amzn1.i686
    php72-json-7.2.26-1.19.amzn1.i686
    php72-mysqlnd-7.2.26-1.19.amzn1.i686
    php72-ldap-7.2.26-1.19.amzn1.i686
    php72-recode-7.2.26-1.19.amzn1.i686
    php72-cli-7.2.26-1.19.amzn1.i686
    php72-pgsql-7.2.26-1.19.amzn1.i686
    php72-intl-7.2.26-1.19.amzn1.i686
    php72-odbc-7.2.26-1.19.amzn1.i686
    php72-process-7.2.26-1.19.amzn1.i686
    php72-bcmath-7.2.26-1.19.amzn1.i686
    php72-devel-7.2.26-1.19.amzn1.i686
    php72-xml-7.2.26-1.19.amzn1.i686
    php72-7.2.26-1.19.amzn1.i686
    php72-gmp-7.2.26-1.19.amzn1.i686
    php72-dbg-7.2.26-1.19.amzn1.i686
    php72-mbstring-7.2.26-1.19.amzn1.i686
    php72-fpm-7.2.26-1.19.amzn1.i686
    php72-imap-7.2.26-1.19.amzn1.i686

src:
    php72-7.2.26-1.19.amzn1.src

x86_64:
    php72-tidy-7.2.26-1.19.amzn1.x86_64
    php72-dba-7.2.26-1.19.amzn1.x86_64
    php72-pdo-7.2.26-1.19.amzn1.x86_64
    php72-gmp-7.2.26-1.19.amzn1.x86_64
    php72-cli-7.2.26-1.19.amzn1.x86_64
    php72-mbstring-7.2.26-1.19.amzn1.x86_64
    php72-xmlrpc-7.2.26-1.19.amzn1.x86_64
    php72-bcmath-7.2.26-1.19.amzn1.x86_64
    php72-pgsql-7.2.26-1.19.amzn1.x86_64
    php72-soap-7.2.26-1.19.amzn1.x86_64
    php72-xml-7.2.26-1.19.amzn1.x86_64
    php72-embedded-7.2.26-1.19.amzn1.x86_64
    php72-intl-7.2.26-1.19.amzn1.x86_64
    php72-snmp-7.2.26-1.19.amzn1.x86_64
    php72-pdo-dblib-7.2.26-1.19.amzn1.x86_64
    php72-imap-7.2.26-1.19.amzn1.x86_64
    php72-debuginfo-7.2.26-1.19.amzn1.x86_64
    php72-odbc-7.2.26-1.19.amzn1.x86_64
    php72-enchant-7.2.26-1.19.amzn1.x86_64
    php72-json-7.2.26-1.19.amzn1.x86_64
    php72-7.2.26-1.19.amzn1.x86_64
    php72-process-7.2.26-1.19.amzn1.x86_64
    php72-ldap-7.2.26-1.19.amzn1.x86_64
    php72-common-7.2.26-1.19.amzn1.x86_64
    php72-dbg-7.2.26-1.19.amzn1.x86_64
    php72-devel-7.2.26-1.19.amzn1.x86_64
    php72-opcache-7.2.26-1.19.amzn1.x86_64
    php72-recode-7.2.26-1.19.amzn1.x86_64
    php72-gd-7.2.26-1.19.amzn1.x86_64
    php72-pspell-7.2.26-1.19.amzn1.x86_64
    php72-fpm-7.2.26-1.19.amzn1.x86_64
    php72-mysqlnd-7.2.26-1.19.amzn1.x86_64