CVE-2025-1735

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):

(CVE-2025-1220)

(CVE-2025-1735)

(CVE-2025-6491)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):

(CVE-2025-1220)

(CVE-2025-1735)

(CVE-2025-6491)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):

(CVE-2025-1220)

(CVE-2025-1735)

(CVE-2025-6491)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.(CVE-2025-1220)

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.(CVE-2025-1735)

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.(CVE-2025-6491)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.(CVE-2025-1220)

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.(CVE-2025-1735)

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.(CVE-2025-6491)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.(CVE-2025-1220)

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.(CVE-2025-1735)

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.(CVE-2025-6491)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: pgsql extension does not check for errors during escaping (CVE-2025-1735)

• php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)

• php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: pgsql extension does not check for errors during escaping (CVE-2025-1735)

• php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)

• php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)

• php: heap-based buffer overflow in array_merge() (CVE-2025-14178)

• php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)

• php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: pgsql extension does not check for errors during escaping (CVE-2025-1735)

• php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)

• php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)

• php: heap-based buffer overflow in array_merge() (CVE-2025-14178)

• php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)

• php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

• php: pgsql extension does not check for errors during escaping (CVE-2025-1735)

• php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)

• php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)

• php: heap-based buffer overflow in array_merge() (CVE-2025-14178)

• php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: pgsql extension does not check for errors during escaping (CVE-2025-1735)
• php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)
• php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: pgsql extension does not check for errors during escaping (CVE-2025-1735)
• php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)
• php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)
• php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
• php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)
• php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: pgsql extension does not check for errors during escaping (CVE-2025-1735)
• php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)
• php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)
• php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
• php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)
• php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)
• php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)
• php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)
• php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
• php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
• php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
• php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
• php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)
• php: pgsql extension does not check for errors during escaping (CVE-2025-1735)
• php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)
• php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)
• php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
• php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

• CVE-2025-1220: error if host contains null bytes in the middle of the string
• CVE-2025-6491: fix NULL pointer dereference vulnerability in soap
• CVE-2025-1735: add error error checks for escape function is pgsql and pdo_pgsql extensions

• CVE-2025-1220: error if host contains null bytes in the middle of the string
• CVE-2025-6491: fix NULL pointer dereference vulnerability in soap
• CVE-2025-1735: add error error checks for escape function is pgsql and pdo_pgsql extensions

• CVE-2025-1220: error if host contains null bytes in the middle of the string
• CVE-2025-6491: fix NULL pointer dereference vulnerability in soap
• CVE-2025-1735: add error error checks for escape function is pgsql and pdo_pgsql extensions

• CVE-2025-1735: add error checking for pgsql extension escape functions, mainly to fix possible issues with multi-byte encoding of Postgres databases

• CVE-2025-1735: add error checking for pgsql extension escape functions, mainly to fix possible issues with multi-byte encoding of Postgres databases

• CVE-2025-1735: add error checking for pgsql extension escape functions, mainly to fix possible issues with multi-byte encoding of Postgres databases

• SECURITY UPDATE: inadequate validation in pgsql and pdo_pgsql functions
  • debian/patches/CVE-2025-1735.patch: Add error checks for escape function in pgsql and pdo_pgsql extensions to prevent potential security issues
  • CVE-2025-1735

• SECURITY UPDATE: inadequate error checking in pgsql and pdo_pgsql escaping functions
  • debian/patches/CVE-2025-1735.patch: Add error checks for escape function in pgsql and pdo_pgsql extensions to prevent storing of improperly escaped data
  • CVE-2025-1735

• SECURITY UPDATE: Inadequate validation in pgsql and pdo_pgsql functions
  • debian/patches/CVE-2025-1735.patch: add error checks for escape function in pgsql and pdo_pgsql extensions to prevent potential security issues
  • CVE-2025-1735
• SECURITY UPDATE: Insufficient HTTP header validation
  • debian/patches/CVE-2025-1736.patch: updates the http user header check for crlf in ext/standard/http_fopen_wrapper.c
  • CVE-2025-1736

• SECURITY UPDATE: fix backport compatibility issue in CVE-2025-1735 patch
  • debian/patches/CVE-2025-1735.patch: fix incompatible function call zend_string_efree replaced with zend_string_free for PHP 7.0.33 compatibility in ext/pgsql/pgsql.c
  • CVE-2025-1735

• SECURITY UPDATE: out-of-bounds access
  • debian/patches/CVE-2017-9118.patch: fix out of bounds access in php_pcre_replace_impl
  • CVE-2017-9118
• SECURITY UPDATE: improper validation of HTTP_REDIRECT_STATUS variable in CGI binary
  • debian/patches/CVE-2024-8927.patch: fix Apache server name check; remove references to redirect.so and Netscape; check configuration override first
  • CVE-2024-8927
• SECURITY UPDATE: buffer overread vulnerability
  • debian/patches/CVE-2024-11233.patch: move bound check upwards to fix single byte overread with convert.quoted-printable-decode filter
  • CVE-2024-11233
• SECURITY UPDATE: URI is not properly sanitized
  • debian/patches/CVE-2024-11234.patch: when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user
  • CVE-2024-11234
• SECURITY UPDATE: incomplete check in escaping functions
  • debian/patches/CVE-2025-1735.patch: pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
  • CVE-2025-1735

• CVE-2025-1735: fix missing error checking that could result in SQL injection and crashes

• CVE-2025-1735: add error checks to prevent crashes and improperly escaped data when PostgreSQL rejects invalid strings

PGSQL: Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during escaping). (CVE-2025-1735) SOAP: Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491) Standard: Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames). (CVE-2025-1220)

These are all security issues fixed in the php8-8.4.10-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php8 fixes the following issues:

Version update to 8.3.23:

• CVE-2025-1220: Fixed null byte termination in hostnames (bsc#1246167)
• CVE-2025-1735: Fixed pgsql extension does not check for errors during escaping (bsc#1246146)
• CVE-2025-6491: Fixed NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (bsc#1246148)

This update for php8 fixes the following issues:

• CVE-2025-1220: Fixed null byte termination in hostnames (bsc#1246167)
• CVE-2025-1735: Fixed pgsql extension does not check for errors during escaping (bsc#1246146)
• CVE-2025-6491: Fixed NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (bsc#1246148)

This update for php7 fixes the following issues:

• CVE-2025-1220: Fixed null byte termination in hostnames (bsc#1246167)
• CVE-2025-1735: Fixed pgsql extension does not check for errors during escaping (bsc#1246146)
• CVE-2025-6491: Fixed NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (bsc#1246148)

This update for php8 fixes the following issues:

Version update to 8.2.29:

• CVE-2025-1220: Fixed null byte termination in hostnames (bsc#1246167)
• CVE-2025-1735: Fixed pgsql extension does not check for errors during escaping (bsc#1246146)
• CVE-2025-6491: Fixed NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (bsc#1246148)

It was discovered that PHP incorrectly handled certain hostnames containing null characters. A remote attacker could possibly use this issue to bypass certain hostname validation checks. (CVE-2025-1220)

It was discovered that PHP incorrectly handled the pgsql and pdo_pgsql escaping functions. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2025-1735)

It was discovered that PHP incorrectly handled parsing certain XML data in SOAP extensions. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2025-6491)