Moderate Security Update for PHP:8.3 Vulnerabilities in AlmaLinux Packages
Summary
ALSA-2025:23309: Moderate: php:8.3 security update. Affects apcu-panel versions < 5.1.23-1.module_el9.6.0+151+5f31e576. Fixed in 5.1.23-1.module_el9.6.0+151+5f31e576. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language that is especially suited for web development. It is embedded within HTML and is commonly used in conjunction with the Apache HTTP Server. The PHP ecosystem includes various extensions and packages, such as php-bcmath, php-cli, and php-gd, which enhance its functionality. However, vulnerabilities in these packages can lead to significant security risks, affecting web applications and server integrity.
Vulnerability Detail
The vulnerabilities identified in PHP 8.3 include issues such as the pgsql extension failing to check for errors during escaping (CVE-2025-1735), a NULL pointer dereference in the PHP SOAP extension when handling large XML namespace prefixes (CVE-2025-6491), and a vulnerability related to null characters in hostnames (CVE-2025-1220). These vulnerabilities can lead to application crashes, data corruption, or unauthorized access, posing serious risks to systems relying on PHP.
How To Fix
Minimum fixed version
5.1.23-1.module_el9.6.0+151+5f31e576
This is the first release that contains the fix.
sudo dnf update apcu-panelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the affected PHP extensions until the packages can be updated. This can be done by commenting out the relevant lines in the php.ini configuration file or using the command line to disable specific extensions.
Conclusion
The vulnerabilities identified in PHP 8.3 pose significant risks to applications running on AlmaLinux. It is crucial to update the affected packages to their patched versions to ensure the security and integrity of your systems. Regular monitoring and prompt updates are essential in maintaining a secure environment.
See every vulnerability recorded for apcu-panel →
FAQ
The main vulnerabilities include error handling issues in the pgsql extension, a NULL pointer dereference in the SOAP extension, and a null character vulnerability in hostnames.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities in real-time.
If immediate updates are not possible, consider disabling the affected PHP extensions as a temporary workaround to mitigate risks.
It is advisable to regularly check for vulnerabilities, especially after major updates or when new vulnerabilities are disclosed.
Detailed information about the vulnerabilities can be found on the CVE pages linked in the advisory, as well as through security bulletins from PHP and AlmaLinux.
Related vulnerabilities
Recent vulnerabilities recorded for apcu-panel.
