Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-14178 (GCVE-0-2025-14178)
Vulnerability from cvelistv5 – Published: 2025-12-27 19:27 – Updated: 2026-01-24 11:04
VLAI?
EPSS
Title
Heap buffer overflow in array_merge()
Summary
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
Severity ?
6.5 (Medium)
Assigner
References
Impacted products
Credits
Niels Dossche
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14178",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-29T16:00:50.197017Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-29T16:01:02.639Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-01-24T11:04:01.892Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00019.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"packageName": "php",
"product": "PHP",
"vendor": "PHP Group",
"versions": [
{
"lessThan": "8.1.34",
"status": "affected",
"version": "8.1.*",
"versionType": "semver"
},
{
"lessThan": "8.2.30",
"status": "affected",
"version": "8.2.*",
"versionType": "semver"
},
{
"lessThan": "8.3.29",
"status": "affected",
"version": "8.3.*",
"versionType": "semver"
},
{
"lessThan": "8.4.16",
"status": "affected",
"version": "8.4.*",
"versionType": "semver"
},
{
"lessThan": "8.5.1",
"status": "affected",
"version": "8.5.*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Niels Dossche"
}
],
"datePublic": "2025-12-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.\u003c/p\u003e"
}
],
"value": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-27T19:27:41.691Z",
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"shortName": "php"
},
"references": [
{
"url": "https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2"
}
],
"source": {
"advisory": "GHSA-h96m-rvf9-jgm2",
"discovery": "INTERNAL"
},
"title": "Heap buffer overflow in array_merge()",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
"assignerShortName": "php",
"cveId": "CVE-2025-14178",
"datePublished": "2025-12-27T19:27:41.691Z",
"dateReserved": "2025-12-06T06:25:31.535Z",
"dateUpdated": "2026-01-24T11:04:01.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2026/01/msg00019.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-01-24T11:04:01.892Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-14178\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-12-29T16:00:50.197017Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-12-29T16:00:57.343Z\"}}], \"cna\": {\"title\": \"Heap buffer overflow in array_merge()\", \"source\": {\"advisory\": \"GHSA-h96m-rvf9-jgm2\", \"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Niels Dossche\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"PHP Group\", \"product\": \"PHP\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.1.*\", \"lessThan\": \"8.1.34\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.2.*\", \"lessThan\": \"8.2.30\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.3.*\", \"lessThan\": \"8.3.29\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.4.*\", \"lessThan\": \"8.4.16\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.5.*\", \"lessThan\": \"8.5.1\", \"versionType\": \"semver\"}], \"packageName\": \"php\", \"defaultStatus\": \"affected\"}], \"datePublic\": \"2025-12-18T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-190\", \"description\": \"CWE-190 Integer Overflow or Wraparound\"}]}], \"providerMetadata\": {\"orgId\": \"dd77f84a-d19a-4638-8c3d-a322d820ed2b\", \"shortName\": \"php\", \"dateUpdated\": \"2025-12-27T19:27:41.691Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-14178\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-24T11:04:01.892Z\", \"dateReserved\": \"2025-12-06T06:25:31.535Z\", \"assignerOrgId\": \"dd77f84a-d19a-4638-8c3d-a322d820ed2b\", \"datePublished\": \"2025-12-27T19:27:41.691Z\", \"assignerShortName\": \"php\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
cve-2025-14178
Vulnerability from osv_almalinux
Published
2026-02-10 00:00
Modified
2026-02-12 10:10
Summary
Moderate: php:7.4 security update
Details
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
- php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)
- php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)
- php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)
- php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
- php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
- php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
- php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
- php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)
- php: pgsql extension does not check for errors during escaping (CVE-2025-1735)
- php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)
- php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)
- php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
- php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "apcu-panel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.18-1.module_el8.6.0+2750+78feabcb"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "libzip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.1-1.module_el8.6.0+3239+bedf0508"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "libzip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.1-1.module_el8.6.0+2750+78feabcb"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "libzip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.1-1.module_el8.10.0+3935+28808425"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "libzip-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.1-1.module_el8.10.0+3935+28808425"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "libzip-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.1-1.module_el8.6.0+3239+bedf0508"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "libzip-tools"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.1-1.module_el8.6.0+3239+bedf0508"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "libzip-tools"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.1-1.module_el8.6.0+2750+78feabcb"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "libzip-tools"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.1-1.module_el8.10.0+3935+28808425"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-bcmath"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-dba"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-dbg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-embedded"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-enchant"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-ffi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-fpm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-gd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-gmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-intl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-json"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-ldap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-mbstring"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-mysqlnd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-odbc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-opcache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pdo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pear"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.10.13-1.module_el8.10.0+3935+28808425"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-apcu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.18-1.module_el8.10.0+3935+28808425"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-apcu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.18-1.module_el8.6.0+2750+78feabcb"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-apcu-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.18-1.module_el8.6.0+2750+78feabcb"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-apcu-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.18-1.module_el8.10.0+3935+28808425"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-rrd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.1-1.module_el8.6.0+2750+78feabcb"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-rrd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.1-1.module_el8.6.0+3239+bedf0508"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-rrd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.1-1.module_el8.10.0+3935+28808425"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-xdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.5-1.module_el8.10.0+3935+28808425"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-xdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.5-1.module_el8.6.0+3239+bedf0508"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-xdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.5-1.module_el8.6.0+2750+78feabcb"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-zip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.2-1.module_el8.6.0+2750+78feabcb"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-zip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.2-1.module_el8.10.0+3935+28808425"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-zip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.2-1.module_el8.6.0+3239+bedf0508"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pgsql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-process"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-snmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-soap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-xmlrpc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.4.33-3.module_el8.10.0+4114+3b36c618"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. \n\nSecurity Fix(es): \n\n * php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)\n * php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)\n * php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)\n * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)\n * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)\n * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)\n * php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)\n * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)\n * php: pgsql extension does not check for errors during escaping (CVE-2025-1735)\n * php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)\n * php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)\n * php: heap-based buffer overflow in array_merge() (CVE-2025-14178)\n * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:2470",
"modified": "2026-02-12T10:10:23Z",
"published": "2026-02-10T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:2470"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2024-11233"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2024-11234"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2024-8929"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-1217"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-1219"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-1220"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14177"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14178"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-1734"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-1735"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-1736"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-1861"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-6491"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2327960"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2328521"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2328523"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2355917"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2356041"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2356042"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2356043"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2356046"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2378689"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2378690"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2379792"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425625"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425626"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2026-2470.html"
}
],
"related": [
"CVE-2024-8929",
"CVE-2024-11233",
"CVE-2024-11234",
"CVE-2025-1217",
"CVE-2025-1736",
"CVE-2025-1734",
"CVE-2025-1219",
"CVE-2025-1861",
"CVE-2025-1735",
"CVE-2025-6491",
"CVE-2025-1220",
"CVE-2025-14178",
"CVE-2025-14177"
],
"summary": "Moderate: php:7.4 security update"
}
cve-2025-14178
Vulnerability from osv_almalinux
Published
2026-01-27 00:00
Modified
2026-02-02 11:20
Summary
Important: php:8.2 security update
Details
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
- php: pgsql extension does not check for errors during escaping (CVE-2025-1735)
- php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)
- php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)
- php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
- php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)
- php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "apcu-panel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el9.4.0+65+49ff6472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-bcmath"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-dba"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-dbg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-embedded"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-enchant"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-ffi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-fpm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-gd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-gmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-intl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-ldap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-mbstring"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-mysqlnd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-odbc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-opcache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pdo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-apcu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el9.4.0+65+49ff6472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-apcu-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el9.4.0+65+49ff6472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-rrd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3-4.module_el9.4.0+65+49ff6472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-xdebug3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.2-2.module_el9.4.0+65+49ff6472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-zip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.22.3-1.module_el9.4.0+65+49ff6472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pgsql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-process"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-snmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-soap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el9.7.0+205+fe410f10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. \n\nSecurity Fix(es): \n\n * php: pgsql extension does not check for errors during escaping (CVE-2025-1735)\n * php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)\n * php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)\n * php: heap-based buffer overflow in array_merge() (CVE-2025-14178)\n * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)\n * php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:1409",
"modified": "2026-02-02T11:20:21Z",
"published": "2026-01-27T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:1409"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-1220"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14177"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14178"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14180"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-1735"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-6491"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2378689"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2378690"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2379792"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425625"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425626"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425627"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2026-1409.html"
}
],
"related": [
"CVE-2025-1735",
"CVE-2025-6491",
"CVE-2025-1220",
"CVE-2025-14178",
"CVE-2025-14177",
"CVE-2025-14180"
],
"summary": "Important: php:8.2 security update"
}
cve-2025-14178
Vulnerability from osv_almalinux
Published
2026-02-02 00:00
Modified
2026-02-02 09:59
Summary
Important: php security update
Details
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
- php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
- php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)
- php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-bcmath"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-dba"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-dbg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-embedded"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-enchant"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-ffi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-fpm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-gd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-gmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-intl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-ldap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-mbstring"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-mysqlnd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-odbc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-opcache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-pdo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-pgsql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-process"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-snmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-soap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "php-xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.el10_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. \n\nSecurity Fix(es): \n\n * php: heap-based buffer overflow in array_merge() (CVE-2025-14178)\n * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)\n * php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:1628",
"modified": "2026-02-02T09:59:40Z",
"published": "2026-02-02T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:1628"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14177"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14178"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14180"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425625"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425626"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425627"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/10/ALSA-2026-1628.html"
}
],
"related": [
"CVE-2025-14178",
"CVE-2025-14177",
"CVE-2025-14180"
],
"summary": "Important: php security update"
}
cve-2025-14178
Vulnerability from osv_almalinux
Published
2026-01-27 00:00
Modified
2026-02-02 11:16
Summary
Important: php:8.2 security update
Details
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
- php: pgsql extension does not check for errors during escaping (CVE-2025-1735)
- php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)
- php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)
- php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
- php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)
- php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "apcu-panel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el8.10.0+3796+30ed3ef7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "libzip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.3-1.module_el8.10.0+3796+30ed3ef7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "libzip-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.3-1.module_el8.10.0+3796+30ed3ef7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "libzip-tools"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.3-1.module_el8.10.0+3796+30ed3ef7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-bcmath"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-dba"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-dbg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-embedded"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-enchant"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-ffi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-fpm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-gd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-gmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-intl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-ldap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-mbstring"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-mysqlnd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-odbc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-opcache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pdo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pear"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.10.14-1.module_el8.10.0+3796+30ed3ef7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-apcu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el8.10.0+3796+30ed3ef7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-apcu-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el8.10.0+3796+30ed3ef7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-rrd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3-1.module_el8.10.0+3796+30ed3ef7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-xdebug3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.2-2.module_el8.10.0+3796+30ed3ef7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pecl-zip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.22.3-1.module_el8.10.0+3796+30ed3ef7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-pgsql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-process"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-snmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-soap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "php-xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.30-1.module_el8.10.0+4108+cff35472"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. \n\nSecurity Fix(es): \n\n * php: pgsql extension does not check for errors during escaping (CVE-2025-1735)\n * php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491)\n * php: PHP Hostname Null Character Vulnerability (CVE-2025-1220)\n * php: heap-based buffer overflow in array_merge() (CVE-2025-14178)\n * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)\n * php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:1412",
"modified": "2026-02-02T11:16:18Z",
"published": "2026-01-27T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:1412"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-1220"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14177"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14178"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14180"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-1735"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-6491"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2378689"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2378690"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2379792"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425625"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425626"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425627"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2026-1412.html"
}
],
"related": [
"CVE-2025-1735",
"CVE-2025-6491",
"CVE-2025-1220",
"CVE-2025-14178",
"CVE-2025-14177",
"CVE-2025-14180"
],
"summary": "Important: php:8.2 security update"
}
cve-2025-14178
Vulnerability from osv_almalinux
Published
2026-01-27 00:00
Modified
2026-01-29 11:59
Summary
Important: php:8.3 security update
Details
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
- php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
- php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)
- php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "apcu-panel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el9.6.0+151+5f31e576"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-bcmath"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-dba"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-dbg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-embedded"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-enchant"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-ffi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-fpm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-gd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-gmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-intl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-ldap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-mbstring"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-mysqlnd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-odbc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-opcache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pdo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-apcu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el9.6.0+151+5f31e576"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-apcu-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.23-1.module_el9.6.0+151+5f31e576"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-redis6"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.0-2.module_el9.6.0+151+5f31e576"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-rrd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3-4.module_el9.6.0+151+5f31e576"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-xdebug3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.1-1.module_el9.6.0+151+5f31e576"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pecl-zip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.22.3-1.module_el9.6.0+151+5f31e576"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pgsql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-process"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-snmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-soap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.29-1.module_el9.7.0+206+f4fec7f3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. \n\nSecurity Fix(es): \n\n * php: heap-based buffer overflow in array_merge() (CVE-2025-14178)\n * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)\n * php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:1429",
"modified": "2026-01-29T11:59:57Z",
"published": "2026-01-27T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:1429"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14177"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14178"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14180"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425625"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425626"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425627"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2026-1429.html"
}
],
"related": [
"CVE-2025-14178",
"CVE-2025-14177",
"CVE-2025-14180"
],
"summary": "Important: php:8.3 security update"
}
cve-2025-14178
Vulnerability from osv_almalinux
Published
2026-02-17 00:00
Modified
2026-02-18 13:30
Summary
Moderate: php security update
Details
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
- php: heap-based buffer overflow in array_merge() (CVE-2025-14178)
- php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-bcmath"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-dba"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-dbg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-embedded"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-enchant"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-ffi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-fpm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-gd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-gmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-intl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-ldap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-mbstring"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-mysqlnd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-odbc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-opcache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pdo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-pgsql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-process"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-snmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-soap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "php-xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.30-5.el9_7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. \n\nSecurity Fix(es): \n\n * php: heap-based buffer overflow in array_merge() (CVE-2025-14178)\n * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:2799",
"modified": "2026-02-18T13:30:42Z",
"published": "2026-02-17T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:2799"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14177"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-14178"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425625"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2425626"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2026-2799.html"
}
],
"related": [
"CVE-2025-14178",
"CVE-2025-14177"
],
"summary": "Moderate: php security update"
}
CERTFR-2025-AVI-1126
Vulnerability from certfr_avis - Published: 2025-12-19 - Updated: 2025-12-22
De multiples vulnérabilités ont été découvertes dans PHP. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "PHP versions 8.3.x ant\u00e9rieures \u00e0 8.3.29",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.4.x ant\u00e9rieures \u00e0 8.4.16",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.5.x ant\u00e9rieures \u00e0 8.5.1",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.2.x ant\u00e9rieures \u00e0 8.2.30",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
},
{
"description": "PHP versions 8.1.x ant\u00e9rieures \u00e0 8.1.34",
"product": {
"name": "PHP",
"vendor": {
"name": "PHP",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-14177",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14177"
},
{
"name": "CVE-2025-67899",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67899"
},
{
"name": "CVE-2025-14180",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14180"
},
{
"name": "CVE-2025-14178",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14178"
}
],
"initial_release_date": "2025-12-19T00:00:00",
"last_revision_date": "2025-12-22T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-1126",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-12-19T00:00:00.000000"
},
{
"description": "Ajout version 8.1.34",
"revision_date": "2025-12-22T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans PHP. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans PHP",
"vendor_advisories": [
{
"published_at": "2025-12-18",
"title": "Bulletin de s\u00e9curit\u00e9 PHP 8.1.34",
"url": "https://www.php.net/ChangeLog-8.php#8.1.34"
},
{
"published_at": "2025-12-18",
"title": "Bulletin de s\u00e9curit\u00e9 PHP 8.3.29",
"url": "https://www.php.net/ChangeLog-8.php#8.3.29"
},
{
"published_at": "2025-12-18",
"title": "Bulletin de s\u00e9curit\u00e9 PHP 8.4.16",
"url": "https://www.php.net/ChangeLog-8.php#8.4.16"
},
{
"published_at": "2025-12-18",
"title": "Bulletin de s\u00e9curit\u00e9 PHP 8.2.30",
"url": "https://www.php.net/ChangeLog-8.php#8.2.30"
},
{
"published_at": "2025-12-18",
"title": "Bulletin de s\u00e9curit\u00e9 PHP 8.5.1",
"url": "https://www.php.net/ChangeLog-8.php#8.5.1"
}
]
}
CERTFR-2026-AVI-0178
Vulnerability from certfr_avis - Published: 2026-02-18 - Updated: 2026-02-18
De multiples vulnérabilités ont été découvertes dans Tenable Security Center. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Tenable | Security Center | Security Center versions 6.5.x antérieures à 6.5.1 sans les correctifs de sécurité SC-202602.1 et SC-202602.2 | ||
| Tenable | Security Center | Security Center versions 6.6.x antérieures à 6.6.0 sans les correctifs de sécurité SC-202602.1 et SC-202602.2 | ||
| Tenable | Security Center | Security Center versions 6.7.x antérieures à 6.7.2 sans les correctifs de sécurité SC-202602.1 et SC-202602.2 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Security Center versions 6.5.x ant\u00e9rieures \u00e0 6.5.1 sans les correctifs de s\u00e9curit\u00e9 SC-202602.1 et SC-202602.2",
"product": {
"name": "Security Center",
"vendor": {
"name": "Tenable",
"scada": false
}
}
},
{
"description": "Security Center versions 6.6.x ant\u00e9rieures \u00e0 6.6.0 sans les correctifs de s\u00e9curit\u00e9 SC-202602.1 et SC-202602.2",
"product": {
"name": "Security Center",
"vendor": {
"name": "Tenable",
"scada": false
}
}
},
{
"description": "Security Center versions 6.7.x ant\u00e9rieures \u00e0 6.7.2 sans les correctifs de s\u00e9curit\u00e9 SC-202602.1 et SC-202602.2",
"product": {
"name": "Security Center",
"vendor": {
"name": "Tenable",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-14177",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14177"
},
{
"name": "CVE-2025-14017",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14017"
},
{
"name": "CVE-2025-54090",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-54090"
},
{
"name": "CVE-2025-13034",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13034"
},
{
"name": "CVE-2025-14180",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14180"
},
{
"name": "CVE-2025-14524",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14524"
},
{
"name": "CVE-2025-15079",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15079"
},
{
"name": "CVE-2026-2630",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2630"
},
{
"name": "CVE-2025-14819",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14819"
},
{
"name": "CVE-2025-14178",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14178"
},
{
"name": "CVE-2025-15224",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15224"
}
],
"initial_release_date": "2026-02-18T00:00:00",
"last_revision_date": "2026-02-18T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0178",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-02-18T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Tenable Security Center. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Tenable Security Center",
"vendor_advisories": [
{
"published_at": "2026-02-17",
"title": "Bulletin de s\u00e9curit\u00e9 Tenable tns-2026-06",
"url": "https://www.tenable.com/security/tns-2026-06"
}
]
}
bit-libphp-2025-14178
Vulnerability from bitnami_vulndb
Published
2026-01-08 11:43
Modified
2026-01-26 15:09
Summary
Heap buffer overflow in array_merge()
Details
In PHP versions:8.1. before 8.1.34, 8.2. before 8.2.30, 8.3. before 8.3.29, 8.4. before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
{
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "libphp",
"purl": "pkg:bitnami/libphp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.34"
},
{
"introduced": "8.2.0"
},
{
"fixed": "8.2.30"
},
{
"introduced": "8.3.0"
},
{
"fixed": "8.3.29"
},
{
"introduced": "8.4.0"
},
{
"fixed": "8.4.16"
},
{
"introduced": "8.5.0"
},
{
"fixed": "8.5.1"
}
],
"type": "SEMVER"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
],
"aliases": [
"CVE-2025-14178"
],
"database_specific": {
"cpes": [
"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
],
"severity": "High"
},
"details": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.",
"id": "BIT-libphp-2025-14178",
"modified": "2026-01-26T15:09:56.435Z",
"published": "2026-01-08T11:43:28.412Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14178"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00019.html"
}
],
"schema_version": "1.6.2",
"summary": "Heap buffer overflow in array_merge()"
}
bit-php-2025-14178
Vulnerability from bitnami_vulndb
Published
2026-01-08 11:48
Modified
2026-01-26 15:09
Summary
Heap buffer overflow in array_merge()
Details
In PHP versions:8.1. before 8.1.34, 8.2. before 8.2.30, 8.3. before 8.3.29, 8.4. before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
{
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "php",
"purl": "pkg:bitnami/php"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.34"
},
{
"introduced": "8.2.0"
},
{
"fixed": "8.2.30"
},
{
"introduced": "8.3.0"
},
{
"fixed": "8.3.29"
},
{
"introduced": "8.4.0"
},
{
"fixed": "8.4.16"
},
{
"introduced": "8.5.0"
},
{
"fixed": "8.5.1"
}
],
"type": "SEMVER"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
],
"aliases": [
"CVE-2025-14178"
],
"database_specific": {
"cpes": [
"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
],
"severity": "High"
},
"details": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.",
"id": "BIT-php-2025-14178",
"modified": "2026-01-26T15:09:56.435Z",
"published": "2026-01-08T11:48:32.142Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14178"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00019.html"
}
],
"schema_version": "1.6.2",
"summary": "Heap buffer overflow in array_merge()"
}
FKIE_CVE-2025-14178
Vulnerability from fkie_nvd - Published: 2025-12-27 20:15 - Updated: 2026-01-24 11:15
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Summary
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"matchCriteriaId": "56FCF002-3946-40DF-A774-75C6DDE6CA26",
"versionEndExcluding": "8.1.34",
"versionStartIncluding": "8.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AB314013-4F2F-40F0-968B-35FEC22CC8A4",
"versionEndExcluding": "8.2.30",
"versionStartIncluding": "8.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DAD5402D-688D-44AA-B083-5157FDC53D7A",
"versionEndExcluding": "8.3.29",
"versionStartIncluding": "8.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8813328B-AC06-4060-916F-CD27144F41E2",
"versionEndExcluding": "8.4.16",
"versionStartIncluding": "8.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E56CD990-B79E-4253-B810-13787B23B028",
"versionEndExcluding": "8.5.1",
"versionStartIncluding": "8.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server."
}
],
"id": "CVE-2025-14178",
"lastModified": "2026-01-24T11:15:49.520",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 4.2,
"source": "security@php.net",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-12-27T20:15:40.570",
"references": [
{
"source": "security@php.net",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00019.html"
}
],
"sourceIdentifier": "security@php.net",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-190"
},
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "security@php.net",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-190"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…