SB2025070427 - Multiple vulnerabilities in PHP

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Improper error handling (CVE-ID: CVE-2025-1735)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect handling of error messages and situations in pgsql extension. A remote attacker can pass specially crafted data to the application and perform a denial of service attack under certain circumstances. 

2) NULL pointer dereference (CVE-ID: CVE-2025-6491)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the PHP SOAP extension. A remote attacker can pass a large XML namespace prefix to the application and perform a denial of service (DoS) attack.

3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2025-1220)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of the null byte in the fsockopen() function implementation when handling hostnames. A remote attacker can pass a specially crafted hostname to the application and force it to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Remediation

Install update from vendor's website.

References

• https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3
• https://www.php.net/ChangeLog-8.php#8.1.33
• https://www.php.net/ChangeLog-8.php#8.4.10
• https://www.php.net/ChangeLog-8.php#8.2.29
• https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x
• https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r