Skip to content
OpenAdvisories
Medium ELSA-2025-23309 3 CVEs

Moderate: php:8.3 security update (Oracle Linux 9)

Published Dec 19, 2025 · Updated Dec 19, 2025

Ecosystem: Oracle Linux

Summary

php
[8.3.26-1]
- rebase to 8.3.26

php-pecl-apcu
[5.1.23-1]
- update to 5.1.23 for PHP 8.2 RHEL-14699

[5.1.21-1]
- update to 5.1.21 for PHP 8.1 #2070040

php-pecl-redis6
[6.1.0-2]
- ignore 1 ONLINE test

[6.1.0-1]
- RHEL build

[6.1.0-1]
- update to 6.1.0
- drop patch merged upstream

[6.1.0~RC2-1]
- update to 6.1.0RC2
- fix test suite with redis 6.2 using patch from
https://github.com/phpredis/phpredis/pull/2555

[6.0.2-3]
- cleanup and modernize spec file

[6.0.2-2]
- use valkey on Fedora 41
- add upstream patch for PHP 8.4

[6.0.2-1]
- update to 6.0.2

[6.0.1-1]
- update to 6.0.1

[6.0.0-1]
- cleanup SCL stuff for Fedora review

[6.0.0-1]
- update to 6.0.0

php-pecl-rrd
[2.0.3-4]
- build for PHP 8.1 #2070040

[2.0.3-3]
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688

[2.0.3-2]
- Rebuilt for RHEL 9 BETA for openssl 3.0
Related: rhbz#1971065

[2.0.3-1]
- update to 2.0.3

[2.0.2-1]
- update to 2.0.2

[2.0.1-17]
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937

[2.0.1-16]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

[2.0.1-15]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

php-pecl-xdebug3
php-pecl-zip
[1.22.3-1]
- update to 1.22.3 for PHP 8.2 RHEL-14699

[1.20.1-1]
- update to 1.20.1 for PHP 8.1 #2070040

Fixed packages 32

ReleasePackageFixed in
Oracle Linux · 9 apcu-panel 0:5.1.23-1.module+el9.6.0+90525+5083e899
Oracle Linux · 9 php 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-bcmath 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-cli 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-common 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-dba 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-dbg 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-devel 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-embedded 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-enchant 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-ffi 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-fpm 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-gd 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-gmp 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-intl 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-ldap 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-mbstring 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-mysqlnd 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-odbc 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-opcache 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-pdo 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-pecl-apcu 0:5.1.23-1.module+el9.6.0+90525+5083e899
Oracle Linux · 9 php-pecl-apcu-devel 0:5.1.23-1.module+el9.6.0+90525+5083e899
Oracle Linux · 9 php-pecl-redis6 0:6.1.0-2.module+el9.6.0+90525+5083e899
Oracle Linux · 9 php-pecl-rrd 0:2.0.3-4.module+el9.6.0+90525+5083e899
Oracle Linux · 9 php-pecl-xdebug3 0:3.3.1-1.module+el9.6.0+90525+5083e899
Oracle Linux · 9 php-pecl-zip 0:1.22.3-1.module+el9.6.0+90525+5083e899
Oracle Linux · 9 php-pgsql 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-process 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-snmp 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-soap 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3
Oracle Linux · 9 php-xml 0:8.3.26-1.module+el9.4.0+90734+c13c2ce3

Vulnerabilities 3

  • Medium 5.9
    CVE-2025-1735

    pgsql extension does not check for errors during escaping

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as inv…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2025-6491

    NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2025-1220

    Null byte termination in hostnames

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() t…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine