This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] PHP fixes 6 vulnerabilities
PHP fixes 6 vulnerabilities in versions 8.1.32, 8.2.28, 8.3.19 and 8.4.5 [1]. The vulnerabilities have been fixed by Debian [2][3], and Gentoo has version 8.2.28 available for some architectures [4]. Individual Debian releases and their fixed PHP versions: bullseye (security) - 7.4.33-1+deb11u8 [2] bookworm (security) - 8.2.28-1~deb12u1 [3]
An unauthenticated remote attacker can potentially bypass the document validity check by sending a specially crafted request with a redirect, created using the DOM or SimpleXML extension. A PoC for the vulnerability has been published and is available at [5].
The vulnerability is present in product:
- PHP; <8.1.32; >=8.2, <8.2.28; >=8.3, <8.3.19; >=8.4, <8.4.5;
CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
More information:
- CVE-2025-1219 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 14. 3. 2025.
Under certain circumstances, an unauthenticated remote attacker can use parts of memory after they have been freed, which may cause overwriting of valid data, a DoS attack and potentially code execution. A PoC for the vulnerability has been published and can be found at [6].
The vulnerability is present in product:
- PHP >=8.3, <8.3.19; >=8.4, <8.4.5;
CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
More information:
- CVE-2024-11235 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 14. 3. 2025.
By sending a specially crafted request, an unauthenticated remote attacker can potentially cause undefined behavior on the server side [7].
The vulnerability is present in product:
- PHP; <8.1.32; >=8.2, <8.2.28; >=8.3, <8.3.19; >=8.4, <8.4.5;
CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
More information:
- CVE-2025-1736 at cve.org, NVD
- CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 14. 3. 2025.
Using social engineering, an unauthenticated remote attacker can potentially redirect the victim to an unexpected part of a website [8].
The vulnerability is present in product:
- PHP; <8.1.32; >=8.2, <8.2.28; >=8.3, <8.3.19; >=8.4, <8.4.5;
CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
More information:
- CVE-2025-1861 at cve.org, NVD
- CWE-682: Incorrect Calculation at cwe.mitre.org
The vulnerability was publicly disclosed 14. 3. 2025.
An unauthenticated remote attacker can potentially bypass security policies by sending a specially crafted response from a web server controlled by the attacker [9].
The vulnerability is present in product:
- PHP; <8.1.32; >=8.2, <8.2.28; >=8.3, <8.3.19; >=8.4, <8.4.5;
CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
More information:
- CVE-2025-1734 at cve.org, NVD
- CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') at cwe.mitre.org
The vulnerability was publicly disclosed 14. 3. 2025.
An unauthenticated remote attacker can potentially pass off a response sent by a web server under their control as a different MIME type. A PoC for the vulnerability has been published and is available at [10].
The vulnerability is present in product:
- PHP; <8.1.32; >=8.2, <8.2.28; >=8.3, <8.3.19; >=8.4, <8.4.5;
CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:X
More information:
- CVE-2025-1217 at cve.org, NVD
- CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') at cwe.mitre.org
The vulnerability was publicly disclosed 14. 3. 2025.
Links
- [1] https://www.openwall.com/lists/oss-security/2025/03/14/6
- [2] https://security-tracker.debian.org/tracker/DLA-4088-1
- [3] https://security-tracker.debian.org/tracker/DSA-5878-1
- [4] https://packages.gentoo.org/packages/dev-lang/php
- [5] https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc
- [6] https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477
- [7] https://github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528
- [8] https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff
- [9] https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44
- [10] https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g
By CESNET, z.s.p.o. Martin Krajči on 21. 3. 2025.