CVE-2025-1734

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):

(CVE-2024-11235)

(CVE-2025-1217)

(CVE-2025-1219)

(CVE-2025-1734)

(CVE-2025-1736)

(CVE-2025-1861)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):

(CVE-2025-1217)

(CVE-2025-1219)

(CVE-2025-1734)

(CVE-2025-1736)

(CVE-2025-1861)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):

(CVE-2025-1217)

(CVE-2025-1219)

(CVE-2025-1734)

(CVE-2025-1736)

(CVE-2025-1861)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):

(CVE-2025-1217)

(CVE-2025-1219)

(CVE-2025-1734)

(CVE-2025-1736)

(CVE-2025-1861)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):

(CVE-2024-11235)

(CVE-2025-1217)

(CVE-2025-1219)

(CVE-2025-1734)

(CVE-2025-1736)

(CVE-2025-1861)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

• php: Reference counting in php_request_shutdown causes Use-After-Free (CVE-2024-11235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

• php: Reference counting in php_request_shutdown causes Use-After-Free (CVE-2024-11235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

• php: pgsql extension does not check for errors during escaping (CVE-2025-1735)

• php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)

• php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)

• php: heap-based buffer overflow in array_merge() (CVE-2025-14178)

• php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)
• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)
• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)
• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)
• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)
• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)
• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)
• php: Reference counting in php_request_shutdown causes Use-After-Free (CVE-2024-11235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)
• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)
• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)
• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)
• php: Reference counting in php_request_shutdown causes Use-After-Free (CVE-2024-11235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)
• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)
• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)
• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)
• php: pgsql extension does not check for errors during escaping (CVE-2025-1735)
• php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)
• php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)
• php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
• php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

• CVE-2025-1734: fail http headers without colon

• CVE-2025-1217: fix handling of folded headers by the http stream parser
• CVE-2025-1734: fix validation of http headers with missing colon
• CVE-2025-1861: fix incorrect http redirect location truncation

• CVE-2025-1217: fix handling of folded headers by the http stream parser
• CVE-2025-1734: fix validation of http headers with missing colon
• CVE-2025-1861: fix incorrect http redirect location truncation

• CVE-2025-1217: fix handling of folded headers by the http stream parser
• CVE-2025-1734: fix validation of http headers with missing colon
• CVE-2025-1861: fix incorrect http redirect location truncation

• CVE-2025-1217: http stream wrapper: fix handling folded headers
• CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
• CVE-2025-1861: fix http redirect location truncation

• CVE-2025-1217: http stream wrapper: fix handling folded headers
• CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
• CVE-2025-1861: fix http redirect location truncation

• SECURITY UPDATE: misinterpretation of HTTP response headers
  • debian/patches/CVE-2025-1217.patch: adds HTTP header folding support for HTTP wrapper response headers in ext/standard/http_fopen_wrapper.c
  • CVE-2025-1217
• SECURITY UPDATE: insufficient HTTP header validation
  • debian/patches/CVE-2025-1734.patch: adds logic to fail invalid HTTP headers in ext/standard/http_fopen_wrapper.c
  • CVE-2025-1734
• SECURITY UPDATE: http redirect location truncation
  • debian/patches/CVE-2025-1861.patch: converts the allocation of location to be on heap instead of stack and errors if the location length is greater than 8086 bytes in ext/standard/http_fopen_wrapper.c
  • CVE-2025-1861
• SECURITY UPDATE: insufficient HTTP header validation
  • debian/patches/CVE-2025-1736.patch: updates the http user header check for crlf in ext/standard/http_fopen_wrapper.c
  • CVE-2025-1736

• SECURITY UPDATE: misinterpretation of HTTP response headers
  • debian/patches/CVE-2025-1217.patch: adds HTTP header folding support for HTTP wrapper response headers in ext/standard/http_fopen_wrapper.c
  • CVE-2025-1217
• SECURITY UPDATE: insufficient HTTP header validation
  • debian/patches/CVE-2025-1734.patch: adds logic to fail invalid HTTP headers in ext/standard/http_fopen_wrapper.c
  • CVE-2025-1734
• SECURITY UPDATE: http redirect location truncation
  • debian/patches/CVE-2025-1861.patch: converts the allocation of location to be on heap instead of stack and errors if the location length is greater than 8086 bytes in ext/standard/http_fopen_wrapper.c
  • CVE-2025-1861
• SECURITY UPDATE: insufficient HTTP header validation
  • debian/patches/CVE-2025-1736.patch: updates the http user header check for crlf in ext/standard/http_fopen_wrapper.c
  • CVE-2025-1736

• SECURITY UPDATE: out-of-bound write
  • debian/patches/CVE-2024-11236: fix integer overflow causing in an out-of-bounds write ldap_escape()
  • CVE-2024-11236
• SECURITY UPDATE: incorrect URL truncation
  • debian/patches/CVE-2025-1861: fix possible incorrect URL truncation and redirecting to a wrong location
  • CVE-2025-1217
  • CVE-2025-1734
  • CVE-2025-1861
• SECURITY UPDATE: inadequate validation of user-supplied headers may lead to header misinterpretation
  • debian/patches/CVE-2025-1736.patch: Fix GHSA-hgf5-96fm-v528: Correct http user header CRLF check
  • CVE-2025-1736

Bugs and security with streams have been fixed.

These are all security issues fixed in the php8-8.3.19-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php8 fixes the following issues:

• CVE-2024-11235: Fixed reference counting in php_request_shutdown causing Use-After-Free (bsc#1239666)
• CVE-2025-1217: Fixed header parser of http stream wrapper not handling folded headers (bsc#1239664)
• CVE-2025-1219: Fixed libxml streams using wrong content-type header when requesting a redirected resource (bsc#1239667)
• CVE-2025-1734: Fixed streams HTTP wrapper not failing for headers with invalid name and no colon (bsc#1239668)
• CVE-2025-1736: Fixed stream HTTP wrapper header check might omitting basic auth header (bsc#1239670)
• CVE-2025-1861: Fixed stream HTTP wrapper truncate redirect location to 1024 bytes (bsc#1239669)