Moderate Security Update for PHP Packages: Addressing Multiple Vulnerabilities
Summary
RLSA-2025:7432: Moderate: php:8.2 security update. Affects php-pecl-apcu versions < 0:5.1.23-1.module+el9.5.0+29598+58484504. Fixed in 0:5.1.23-1.module+el9.5.0+29598+58484504. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language widely utilized in web development, particularly with the Apache HTTP Server. The affected packages, including php-pecl-apcu, php-pecl-rrd, php-pecl-xdebug3, and php-pecl-zip, are extensions that enhance PHP's functionality. These packages are crucial for performance optimization, debugging, and file handling in PHP applications. However, they have been identified with vulnerabilities that could potentially compromise the security of applications relying on them.
Vulnerability Detail
The vulnerabilities stem from various issues within PHP, including a heap buffer over-read in mysqlnd, single byte overread in the quoted-printable decode filter, and improper handling of headers in HTTP stream wrappers. These vulnerabilities could lead to unauthorized access, data leakage, or denial of service, posing significant risks to applications that utilize these PHP packages.
How To Fix
Minimum fixed version
0:5.1.23-1.module+el9.5.0+29598+58484504
This is the first release that contains the fix.
sudo dnf update php-pecl-apcuTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updates cannot be applied, consider implementing input validation and sanitization to mitigate the risks associated with these vulnerabilities. Additionally, review and restrict the use of HTTP headers in your application to prevent potential CRLF injection attacks.
Conclusion
The identified vulnerabilities in PHP packages pose significant risks to applications. It is crucial to update the affected packages to their patched versions to ensure the security and integrity of your applications. Regular monitoring and proactive measures can help mitigate potential threats.
See every vulnerability recorded for php-pecl-apcu →
FAQ
The vulnerabilities include heap buffer over-read, single byte overread, CRLF injection in URIs, and improper handling of HTTP headers.
Exploitation could lead to unauthorized access, data leakage, or denial of service, compromising the security of applications.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by analyzing your manifest file.
Implementing input validation and sanitization can help mitigate risks until updates are applied.
The CVSS score for the vulnerabilities is 5.8, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for php-pecl-apcu.
