Debian Linux: Unauthenticated Remote Code Execution in libssh2

Summary

A vulnerability in the libssh2 library used by Debian Linux allows an attacker to execute malicious code on a server without needing a password. This could happen if a server is accessed over the internet using SSH. To fix this, update your Debian Linux installation to the latest version of the affected package.

What to do

Update debian php8.4 to version 8.4.21-1~deb13u1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:13	debian	php8.4	< 8.4.21-1~deb13u1 Fix: upgrade to 8.4.21-1~deb13u1
Debian:14	debian	php8.4	All versions

Original title

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrec...

Original description

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.

https://security-tracker.debian.org/tracker/CVE-2026-6104 Vendor Advisory