Most recent entries from all

ALSA-2026:1409 — Important: php:8.2 security update

Affected: AlmaLinux:9: apcu-panel, AlmaLinux:9: php, AlmaLinux:9: php-bcmath, AlmaLinux:9: php-cli, AlmaLinux:9: php-common, AlmaLinux:9: php-dba, AlmaLinux:9: php-dbg, AlmaLinux:9: php-devel, AlmaLinux:9: php-embedded, AlmaLinux:9: php-enchant and 21 more

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: pgsql extension does not check for errors during escaping (CVE-2025-1735) * php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491) * php: PHP Hostname Null Character Vulnerability (CVE-2025-1220) * php: heap-based buffer overflow in array_merge() (CVE-2025-14178) * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177) * php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-02748

BELL-CVE-2025-14177

Affected: Alpaquita:23: php81, Alpaquita:25: php83, Alpaquita:stream: php83

BIT-libphp-2025-14177 — Information Leak of Memory in getimagesize

Affected: Bitnami: libphp

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.

certfr-2025-avi-1126 — De multiples vulnérabilités ont été découvertes dans PHP. Elles permettent à un attaquant de provoquer un problème de s…

certfr-2025-avi-1126

EUVD-2026-264518

fkie_cve-2025-14177

msrc_CVE-2025-14177 — Information Leak of Memory in getimagesize

msrc_CVE-2025-14177

OESA-2026-1020 — php security update

Affected: openEuler:22.03-LTS-SP3: php

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif Security Fix(es):

A memory information leak vulnerability exists in PHP's getimagesize function. Attackers may exploit this vulnerability to obtain sensitive memory information. The vulnerability affects multiple PHP versions including 8.1.x, 8.2.x, 8.3.x, 8.4.x, and 8.5.x series.(CVE-2025-14177)

A heap buffer overflow vulnerability exists in the array_merge() function of PHP. If we were using a memory safe language we would be limited to DoS attacks, but now we have heap corruption risks. This bug has been in PHP since PHP 7.1.(CVE-2025-14178)

openSUSE-SU-2025:15837-1 — php8-8.4.16-1.1 on GA media

php8-8.4.16-1.1 on GA media

RHSA-2026:7614 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images php: heap-based buffer overflow in array_merge() php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement

SUSE-SU-2026:0071-1 — Security update for php8

Security update for php8

UBUNTU-CVE-2025-14177

Affected: Ubuntu:24.04:LTS: php8.3, Ubuntu:25.10: php8.4

WID-SEC-W-2025-2887 — PHP: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, um einen Server-Side Request-Forgery Angriff ausführen oder nicht bekannte Auswirkungen erzielen.