{"schema_version":"1.7.2","id":"OESA-2025-1889","modified":"2025-07-25T13:16:37Z","published":"2025-07-25T13:16:37Z","upstream":["CVE-2025-1220","CVE-2025-1735","CVE-2025-6491"],"summary":"php security update","details":"PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif\r\n\r\nSecurity Fix(es):\n\nIn PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.(CVE-2025-1220)\n\nIn PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.(CVE-2025-1735)\n\nIn PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.(CVE-2025-6491)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"php","purl":"pkg:rpm/openEuler/php&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.23-1.oe2403sp1"}]}],"ecosystem_specific":{"aarch64":["php-8.3.23-1.oe2403sp1.aarch64.rpm","php-bcmath-8.3.23-1.oe2403sp1.aarch64.rpm","php-cli-8.3.23-1.oe2403sp1.aarch64.rpm","php-common-8.3.23-1.oe2403sp1.aarch64.rpm","php-dba-8.3.23-1.oe2403sp1.aarch64.rpm","php-dbg-8.3.23-1.oe2403sp1.aarch64.rpm","php-debuginfo-8.3.23-1.oe2403sp1.aarch64.rpm","php-debugsource-8.3.23-1.oe2403sp1.aarch64.rpm","php-devel-8.3.23-1.oe2403sp1.aarch64.rpm","php-embedded-8.3.23-1.oe2403sp1.aarch64.rpm","php-enchant-8.3.23-1.oe2403sp1.aarch64.rpm","php-ffi-8.3.23-1.oe2403sp1.aarch64.rpm","php-fpm-8.3.23-1.oe2403sp1.aarch64.rpm","php-gd-8.3.23-1.oe2403sp1.aarch64.rpm","php-gmp-8.3.23-1.oe2403sp1.aarch64.rpm","php-intl-8.3.23-1.oe2403sp1.aarch64.rpm","php-ldap-8.3.23-1.oe2403sp1.aarch64.rpm","php-mbstring-8.3.23-1.oe2403sp1.aarch64.rpm","php-mysqlnd-8.3.23-1.oe2403sp1.aarch64.rpm","php-odbc-8.3.23-1.oe2403sp1.aarch64.rpm","php-opcache-8.3.23-1.oe2403sp1.aarch64.rpm","php-pdo-8.3.23-1.oe2403sp1.aarch64.rpm","php-pgsql-8.3.23-1.oe2403sp1.aarch64.rpm","php-process-8.3.23-1.oe2403sp1.aarch64.rpm","php-snmp-8.3.23-1.oe2403sp1.aarch64.rpm","php-soap-8.3.23-1.oe2403sp1.aarch64.rpm","php-sodium-8.3.23-1.oe2403sp1.aarch64.rpm","php-tidy-8.3.23-1.oe2403sp1.aarch64.rpm","php-xml-8.3.23-1.oe2403sp1.aarch64.rpm"],"noarch":["php-help-8.3.23-1.oe2403sp1.noarch.rpm"],"src":["php-8.3.23-1.oe2403sp1.src.rpm"],"x86_64":["php-8.3.23-1.oe2403sp1.x86_64.rpm","php-bcmath-8.3.23-1.oe2403sp1.x86_64.rpm","php-cli-8.3.23-1.oe2403sp1.x86_64.rpm","php-common-8.3.23-1.oe2403sp1.x86_64.rpm","php-dba-8.3.23-1.oe2403sp1.x86_64.rpm","php-dbg-8.3.23-1.oe2403sp1.x86_64.rpm","php-debuginfo-8.3.23-1.oe2403sp1.x86_64.rpm","php-debugsource-8.3.23-1.oe2403sp1.x86_64.rpm","php-devel-8.3.23-1.oe2403sp1.x86_64.rpm","php-embedded-8.3.23-1.oe2403sp1.x86_64.rpm","php-enchant-8.3.23-1.oe2403sp1.x86_64.rpm","php-ffi-8.3.23-1.oe2403sp1.x86_64.rpm","php-fpm-8.3.23-1.oe2403sp1.x86_64.rpm","php-gd-8.3.23-1.oe2403sp1.x86_64.rpm","php-gmp-8.3.23-1.oe2403sp1.x86_64.rpm","php-intl-8.3.23-1.oe2403sp1.x86_64.rpm","php-ldap-8.3.23-1.oe2403sp1.x86_64.rpm","php-mbstring-8.3.23-1.oe2403sp1.x86_64.rpm","php-mysqlnd-8.3.23-1.oe2403sp1.x86_64.rpm","php-odbc-8.3.23-1.oe2403sp1.x86_64.rpm","php-opcache-8.3.23-1.oe2403sp1.x86_64.rpm","php-pdo-8.3.23-1.oe2403sp1.x86_64.rpm","php-pgsql-8.3.23-1.oe2403sp1.x86_64.rpm","php-process-8.3.23-1.oe2403sp1.x86_64.rpm","php-snmp-8.3.23-1.oe2403sp1.x86_64.rpm","php-soap-8.3.23-1.oe2403sp1.x86_64.rpm","php-sodium-8.3.23-1.oe2403sp1.x86_64.rpm","php-tidy-8.3.23-1.oe2403sp1.x86_64.rpm","php-xml-8.3.23-1.oe2403sp1.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1889"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1220"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1735"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6491"}],"database_specific":{"severity":"High"}}