Summary
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
* php: pgsql extension does not check for errors during escaping (CVE-2025-1735)
* php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)
* php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | php | 0:8.3.26-1.module+el9.7.0+40049+21bbec6b |
| Rocky Linux · 9 | php-pecl-apcu | 0:5.1.23-1.module+el9.7.0+40004+bf50a568 |
| Rocky Linux · 9 | php-pecl-apcu | 0:5.1.23-1.module+el9.7.0+40005+715283ec |
| Rocky Linux · 9 | php-pecl-redis6 | 0:6.1.0-2.module+el9.7.0+40005+715283ec |
| Rocky Linux · 9 | php-pecl-rrd | 0:2.0.3-4.module+el9.7.0+40003+454ed3c4 |
| Rocky Linux · 9 | php-pecl-rrd | 0:2.0.3-4.module+el9.7.0+40005+715283ec |
| Rocky Linux · 9 | php-pecl-rrd | 0:2.0.3-4.module+el9.7.0+40004+bf50a568 |
| Rocky Linux · 9 | php-pecl-xdebug3 | 0:3.3.1-1.module+el9.7.0+40005+715283ec |
| Rocky Linux · 9 | php-pecl-zip | 0:1.22.3-1.module+el9.7.0+40005+715283ec |
| Rocky Linux · 9 | php-pecl-zip | 0:1.22.3-1.module+el9.7.0+40004+bf50a568 |
Vulnerabilities 3
-
Medium 5.9
pgsql extension does not check for errors during escaping
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as inv…
-
Medium 5.9
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the…
-
Low 3.7
Null byte termination in hostnames
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() t…