Skip to content
OpenAdvisories
Medium ALAS2023-2025-1113 3 CVEs

Moderate: php8.4 security update (Amazon Linux 2023)

Published Jul 26, 2025 · Updated Aug 8, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-6491: If a SoapVar instance is created with a fully qualified name larger than 2G, this will cause a NULL pointer dereference resulting in a segmentation fault, leading to a denial of service. CVE-2025-1735: Missing error checking could result in SQL injection and missing error handling could lead to crashes due to null pointer dereferences. CVE-2025-1220: fsockopen() doesn't regard hostname as well, hostname is terminated at the null byte. This can cause Server Side Request Forgery in general case.

Fixed packages 58

ReleasePackageFixed in
Amazon Linux · 2023 php8.4 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-bcmath 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-bcmath-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-cli 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-cli-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-common 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-common-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-dba 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-dba-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-dbg 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-dbg-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-debugsource 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-devel 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-embedded 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-embedded-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-enchant 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-enchant-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-ffi 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-ffi-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-fpm 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-fpm-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-gd 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-gd-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-gmp 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-gmp-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-intl 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-intl-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-ldap 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-ldap-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-mbstring 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-mbstring-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-modphp 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-modphp-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-mysqlnd 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-mysqlnd-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-odbc 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-odbc-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-opcache 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-opcache-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-pdo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-pdo-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-pgsql 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-pgsql-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-process 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-process-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-snmp 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-snmp-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-soap 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-soap-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-sodium 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-sodium-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-tidy 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-tidy-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-xml 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-xml-debuginfo 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-zip 0:8.4.10-1.amzn2023.0.1
Amazon Linux · 2023 php8.4-zip-debuginfo 0:8.4.10-1.amzn2023.0.1

Vulnerabilities 3

  • Medium 5.9
    CVE-2025-1735

    pgsql extension does not check for errors during escaping

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as inv…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2025-6491

    NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2025-1220

    Null byte termination in hostnames

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() t…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-1220.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-1735.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-6491.html