Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
PHP 8.2 can crash servers or expose data
published 9 months ago
Summary
The PHP 8.2 package for AlmaLinux has several coding errors that could let an attacker cause the application to stop working, reveal information, or even gain limited access to the system. These issues affect functions such as database handling, SOAP processing, image handling and array merging. Apply the latest PHP update from AlmaLinux as soon as possible to remove the risk.
What to do
- Update almalinux apcu-panel to version 5.1.23-1.module_el8.10.0+3796+30ed3ef7.
- Update almalinux libzip to version 1.7.3-1.module_el8.10.0+3796+30ed3ef7.
- Update almalinux libzip-devel to version 1.7.3-1.module_el8.10.0+3796+30ed3ef7.
- Update almalinux libzip-tools to version 1.7.3-1.module_el8.10.0+3796+30ed3ef7.
- Update almalinux php to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-bcmath to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-cli to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-common to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-dba to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-dbg to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-devel to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-embedded to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-enchant to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-ffi to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-fpm to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-gd to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-gmp to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-intl to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-ldap to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-mbstring to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-mysqlnd to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-odbc to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-opcache to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-pdo to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-pear to version 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7.
- Update almalinux php-pecl-apcu to version 5.1.23-1.module_el8.10.0+3796+30ed3ef7.
- Update almalinux php-pecl-apcu-devel to version 5.1.23-1.module_el8.10.0+3796+30ed3ef7.
- Update almalinux php-pecl-rrd to version 2.0.3-1.module_el8.10.0+3796+30ed3ef7.
- Update almalinux php-pecl-xdebug3 to version 3.2.2-2.module_el8.10.0+3796+30ed3ef7.
- Update almalinux php-pecl-zip to version 1.22.3-1.module_el8.10.0+3796+30ed3ef7.
- Update almalinux php-pgsql to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-process to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-snmp to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-soap to version 8.2.30-1.module_el8.10.0+4108+cff35472.
- Update almalinux php-xml to version 8.2.30-1.module_el8.10.0+4108+cff35472.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | apcu-panel |
< 5.1.23-1.module_el8.10.0+3796+30ed3ef7 Fix: upgrade to 5.1.23-1.module_el8.10.0+3796+30ed3ef7
|
| AlmaLinux:8 | almalinux | libzip |
< 1.7.3-1.module_el8.10.0+3796+30ed3ef7 Fix: upgrade to 1.7.3-1.module_el8.10.0+3796+30ed3ef7
|
| AlmaLinux:8 | almalinux | libzip-devel |
< 1.7.3-1.module_el8.10.0+3796+30ed3ef7 Fix: upgrade to 1.7.3-1.module_el8.10.0+3796+30ed3ef7
|
| AlmaLinux:8 | almalinux | libzip-tools |
< 1.7.3-1.module_el8.10.0+3796+30ed3ef7 Fix: upgrade to 1.7.3-1.module_el8.10.0+3796+30ed3ef7
|
| AlmaLinux:8 | almalinux | php |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-bcmath |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-cli |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-common |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-dba |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-dbg |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-devel |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-embedded |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-enchant |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-ffi |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-fpm |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-gd |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-gmp |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-intl |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-ldap |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-mbstring |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-mysqlnd |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-odbc |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-opcache |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-pdo |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-pear |
< 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7 Fix: upgrade to 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7
|
| AlmaLinux:8 | almalinux | php-pecl-apcu |
< 5.1.23-1.module_el8.10.0+3796+30ed3ef7 Fix: upgrade to 5.1.23-1.module_el8.10.0+3796+30ed3ef7
|
| AlmaLinux:8 | almalinux | php-pecl-apcu-devel |
< 5.1.23-1.module_el8.10.0+3796+30ed3ef7 Fix: upgrade to 5.1.23-1.module_el8.10.0+3796+30ed3ef7
|
| AlmaLinux:8 | almalinux | php-pecl-rrd |
< 2.0.3-1.module_el8.10.0+3796+30ed3ef7 Fix: upgrade to 2.0.3-1.module_el8.10.0+3796+30ed3ef7
|
| AlmaLinux:8 | almalinux | php-pecl-xdebug3 |
< 3.2.2-2.module_el8.10.0+3796+30ed3ef7 Fix: upgrade to 3.2.2-2.module_el8.10.0+3796+30ed3ef7
|
| AlmaLinux:8 | almalinux | php-pecl-zip |
< 1.22.3-1.module_el8.10.0+3796+30ed3ef7 Fix: upgrade to 1.22.3-1.module_el8.10.0+3796+30ed3ef7
|
| AlmaLinux:8 | almalinux | php-pgsql |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-process |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-snmp |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-soap |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
| AlmaLinux:8 | almalinux | php-xml |
< 8.2.30-1.module_el8.10.0+4108+cff35472 Fix: upgrade to 8.2.30-1.module_el8.10.0+4108+cff35472
|
Original advisory text
Important: php:8.2 security update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
* php: pgsql extension does not check for errors during escaping (CVE-2025-1735)
* php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)
* php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)
* php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
* php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)
* php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* php: pgsql extension does not check for errors during escaping (CVE-2025-1735)
* php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)
* php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)
* php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
* php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)
* php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:1412 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-1220 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-14177 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-14178 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-14180 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-1735 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-6491 Third Party Advisory
- https://bugzilla.redhat.com/2378689 Third Party Advisory
- https://bugzilla.redhat.com/2378690 Third Party Advisory
- https://bugzilla.redhat.com/2379792 Third Party Advisory
- https://bugzilla.redhat.com/2425625 Third Party Advisory
- https://bugzilla.redhat.com/2425626 Third Party Advisory
- https://bugzilla.redhat.com/2425627 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-1412.html Vendor Advisory
Timeline
Published27 Jan 2026
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2026:1412 · OSV
Track software like this
Free during beta