Skip to content
OpenAdvisories
High RLSA-2026:1412 6 CVEs

Important: php:8.2 security update

Published Jan 28, 2026 · Updated Jan 28, 2026

Ecosystem: Rocky Linux

Summary

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: pgsql extension does not check for errors during escaping (CVE-2025-1735)

* php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)

* php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)

* php: heap-based buffer overflow in array_merge() (CVE-2025-14178)

* php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)

* php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 15

ReleasePackageFixed in
Rocky Linux · 8 libzip 0:1.7.3-1.module+el8.10.0+1605+02e07af7
Rocky Linux · 8 libzip 0:1.7.3-1.module+el8.10.0+1596+477f03f8
Rocky Linux · 8 libzip 0:1.7.3-1.module+el8.10.0+1911+f499711e
Rocky Linux · 8 php 0:8.2.30-1.module+el8.10.0+40072+7124940c
Rocky Linux · 8 php-pear 1:1.10.14-1.module+el8.10.0+1596+477f03f8
Rocky Linux · 8 php-pear 1:1.10.14-1.module+el8.10.0+1911+f499711e
Rocky Linux · 8 php-pecl-apcu 0:5.1.23-1.module+el8.10.0+1911+f499711e
Rocky Linux · 8 php-pecl-apcu 0:5.1.23-1.module+el8.10.0+1596+477f03f8
Rocky Linux · 8 php-pecl-rrd 0:2.0.3-1.module+el8.10.0+1911+f499711e
Rocky Linux · 8 php-pecl-rrd 0:2.0.3-1.module+el8.10.0+1596+477f03f8
Rocky Linux · 8 php-pecl-rrd 0:2.0.3-1.module+el8.10.0+1605+02e07af7
Rocky Linux · 8 php-pecl-xdebug3 0:3.2.2-2.module+el8.10.0+1596+477f03f8
Rocky Linux · 8 php-pecl-xdebug3 0:3.2.2-2.module+el8.10.0+1911+f499711e
Rocky Linux · 8 php-pecl-zip 0:1.22.3-1.module+el8.10.0+1911+f499711e
Rocky Linux · 8 php-pecl-zip 0:1.22.3-1.module+el8.10.0+1596+477f03f8

Vulnerabilities 6

  • High 8.2
    CVE-2025-14180

    NULL Pointer Dereference in PDO quoting

    In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared sta…

    PHP Group PHP php php8.1 Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2025-14178

    Heap buffer overflow in array_merge()

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to a…

    PHP Group PHP php7.2 php7.4 Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2025-14177 Public exploit

    Information Leak of Memory in getimagesize

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode …

    PHP Group PHP php php8.2 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2025-1735

    pgsql extension does not check for errors during escaping

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as inv…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2025-6491

    NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2025-1220

    Null byte termination in hostnames

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() t…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2378689
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2378690
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2379792
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2425625
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2425626
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2425627