Red Hat Security Advisory

RHSA-2025:23309

php:8.3 security update

Released 2025-12-18 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) apcu-panel-5.1.23-1.module+el9.6.0+22647+1741ae35.noarch::php:8.3, php-8.3.26-1.module+el9.7.0+23549+c13c2ce3.aarch64::php:8.3, php-8.3.26-1.module+el9.7.0+23549+c13c2ce3.ppc64le::php:8.3 +47

Fixes 3 records

TI-2025-05892 CVE-2025-6491

NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

MEDIUM 60

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01117 Published 2025-07-13 Partial fix · 8.1.33, 8.2.29 +2 CWE-476

TI-2025-01044 CVE-2025-1220

Null byte termination in hostnames

MEDIUM 57

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0074 Published 2025-07-13 Partial fix · 8.1.33, 8.2.29 +2 CWE-918

TI-2025-01493 CVE-2025-1735

pgsql extension does not check for errors during escaping

LOW 35

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01157 Published 2025-07-13 Partial fix · 8.1.33, 8.2.29 +2 CWE-476