Skip to content
OpenAdvisories
High ELSA-2026-1409 6 CVEs

Important: php:8.2 security update (Oracle Linux 9)

Published Jan 29, 2026 · Updated Jan 29, 2026

Ecosystem: Oracle Linux

Summary

php
[8.2.30-1]
- rebase to 8.2.30

php-pecl-apcu
php-pecl-rrd
php-pecl-xdebug3
php-pecl-zip

Fixed packages 31

ReleasePackageFixed in
Oracle Linux · 9 apcu-panel 0:5.1.23-1.module+el9.4.0+90261+af5cc950
Oracle Linux · 9 php 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-bcmath 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-cli 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-common 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-dba 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-dbg 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-devel 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-embedded 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-enchant 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-ffi 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-fpm 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-gd 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-gmp 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-intl 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-ldap 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-mbstring 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-mysqlnd 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-odbc 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-opcache 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-pdo 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-pecl-apcu 0:5.1.23-1.module+el9.4.0+90261+af5cc950
Oracle Linux · 9 php-pecl-apcu-devel 0:5.1.23-1.module+el9.4.0+90261+af5cc950
Oracle Linux · 9 php-pecl-rrd 0:2.0.3-4.module+el9.4.0+90261+af5cc950
Oracle Linux · 9 php-pecl-xdebug3 0:3.2.2-2.module+el9.4.0+90261+af5cc950
Oracle Linux · 9 php-pecl-zip 0:1.22.3-1.module+el9.4.0+90261+af5cc950
Oracle Linux · 9 php-pgsql 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-process 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-snmp 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-soap 0:8.2.30-1.module+el9.7.0+90777+7055ad44
Oracle Linux · 9 php-xml 0:8.2.30-1.module+el9.7.0+90777+7055ad44

Vulnerabilities 6

  • High 8.2
    CVE-2025-14180

    NULL Pointer Dereference in PDO quoting

    In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared sta…

    PHP Group PHP php php8.1 Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2025-14178

    Heap buffer overflow in array_merge()

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to a…

    PHP Group PHP php7.2 php7.4 Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2025-14177 Public exploit

    Information Leak of Memory in getimagesize

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode …

    PHP Group PHP php php8.2 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2025-1735

    pgsql extension does not check for errors during escaping

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as inv…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2025-6491

    NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2025-1220

    Null byte termination in hostnames

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() t…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine