p PatchFirst

RLSA-2026:2470

RLSA-2026:2470 · Moderate: php:7.4 security update

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929) * php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233) * php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234) * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217) * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736) * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734) * php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219) * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861) * php: pgsql extension does not check for errors during escaping (CVE-2025-1735) * php: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVE-2025-6491) * php: PHP Hostname Null Character Vulnerability (CVE-2025-1220) * php: heap-based buffer overflow in array_merge() (CVE-2025-14178) * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVSS 6.5 · Medium · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libzip Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.6.1-1.module+el8.10.0+1912+72767185

    Update to 0:1.6.1-1.module+el8.10.0+1912+72767185

  • php-pear Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 1:1.10.13-1.module+el8.10.0+1912+72767185

    Update to 1:1.10.13-1.module+el8.10.0+1912+72767185

  • php-pear Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 1:1.10.13-1.module+el8.10.0+1605+02e07af7

    Update to 1:1.10.13-1.module+el8.10.0+1605+02e07af7

  • php-pecl-apcu Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:5.1.18-1.module+el8.10.0+1912+72767185

    Update to 0:5.1.18-1.module+el8.10.0+1912+72767185

  • php-pecl-rrd Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:2.0.1-1.module+el8.4.0+414+2e7afcdd

    Update to 0:2.0.1-1.module+el8.4.0+414+2e7afcdd

  • php-pecl-rrd Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:2.0.1-1.module+el8.10.0+1912+72767185

    Update to 0:2.0.1-1.module+el8.10.0+1912+72767185

  • php-pecl-xdebug Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:2.9.5-1.module+el8.10.0+1912+72767185

    Update to 0:2.9.5-1.module+el8.10.0+1912+72767185

  • php-pecl-zip Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.18.2-1.module+el8.10.0+1912+72767185

    Update to 0:1.18.2-1.module+el8.10.0+1912+72767185

Original sources

Check your server →