Summary
USN-7648-1 fixed several vulnerabilities in PHP. This update
provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu
18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled certain hostnames containing
null characters. A remote attacker could possibly use this issue to bypass
certain hostname validation checks. (CVE-2025-1220)
It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql
escaping functions. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)
It was discovered that PHP incorrectly handled parsing certain XML data in
SOAP extensions. A remote attacker could possibly use this issue to cause
PHP to crash, resulting in a denial of service. (CVE-2025-6491)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | php7.0 | 7.0.33-0ubuntu0.16.04.16+esm16 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | php7.2 | 7.2.24-0ubuntu0.18.04.17+esm9 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | php7.4 | 7.4.3-4ubuntu2.29+esm1 |
Vulnerabilities 3
-
Medium 5.9
pgsql extension does not check for errors during escaping
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as inv…
-
Medium 5.9
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the…
-
Low 3.7
Null byte termination in hostnames
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() t…