This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] PHP fixes 3 vulnerabilities
PHP fixes 3 vulnerabilities with versions 8.4.10, 8.3.23, 8.2.29 and 8.1.33 [1][2][3]. Red Hat has not yet released fixes and Debian has released a fix only for the unstable and testing releases [4][5][6][7][8][9]. On Gentoo, the fixed versions, except for 8.1.33, are available as testing [13]. Ubuntu releases and their fixed versions [10][11][12]: Jammy - 8.1.2-1ubuntu2.22 Noble - 8.3.6-0ubuntu0.24.04.5 Plucky - 8.4.5-1ubuntu1.1
An unauthenticated remote attacker can cause a DoS attack on the server and possibly carry out an SQL attack against it by sending a specially crafted value [1].
The vulnerability is present in products:
- Windows:PHP; >=8.1, <8.1.33; >=8.2, <8.2.29; >=8.3, <8.3.23; >=8.4, <8.4.10;
- PHP; >=8.1, <8.1.33; >=8.2, <8.2.29; >=8.3, <8.3.23; >=8.4, <8.4.10;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-1735 at cve.org, NVD
- CWE-476: NULL Pointer Dereference at cwe.mitre.org
The vulnerability was publicly disclosed 13. 7. 2025.
An unauthenticated remote attacker can potentially carry out a DoS attack by sending a specially crafted SOAP message. A PoC script has been published for the vulnerability and can be found at [2].
The vulnerability is present in products:
- Windows:PHP; >=8.1, <8.1.33; >=8.2, <8.2.29; >=8.3, <8.3.23; >=8.4, <8.4.10;
- PHP; >=8.1, <8.1.33; >=8.2, <8.2.29; >=8.3, <8.3.23; >=8.4, <8.4.10;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-6491 at cve.org, NVD
- CWE-476: NULL Pointer Dereference at cwe.mitre.org
The vulnerability was publicly disclosed 13. 7. 2025.
An unauthenticated remote attacker can carry out an SSRF attack by supplying a specially crafted domain name. A PoC script has been published for the vulnerability and can be found at [3].
The vulnerability is present in products:
- Windows:PHP; >=8.1, <8.1.33; >=8.2, <8.2.29; >=8.3, <8.3.23; >=8.4, <8.4.10;
- PHP; >=8.1, <8.1.33; >=8.2, <8.2.29; >=8.3, <8.3.23; >=8.4, <8.4.10;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2025-1220 at cve.org, NVD
- CWE-918: Server-Side Request Forgery (SSRF) at cwe.mitre.org
The vulnerability was publicly disclosed 13. 7. 2025.
Links
- [1] https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3
- [2] https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x
- [3] https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r
- [4] https://access.redhat.com/security/cve/CVE-2025-1220
- [5] https://access.redhat.com/security/cve/CVE-2025-6491
- [6] https://access.redhat.com/security/cve/CVE-2025-1735
- [7] https://security-tracker.debian.org/tracker/CVE-2025-1220
- [8] https://security-tracker.debian.org/tracker/CVE-2025-6491
- [9] https://security-tracker.debian.org/tracker/CVE-2025-1735
- [10] https://ubuntu.com/security/CVE-2025-1220
- [11] https://ubuntu.com/security/CVE-2025-6491
- [12] https://ubuntu.com/security/CVE-2025-1735
- [13] https://packages.gentoo.org/packages/dev-lang/php
By CESNET, z.s.p.o. Martin Krajči on 25. 7. 2025.