CVE-2025-6491
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
Résumé
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.33"},{"introduced":"8.2.0"},{"fixed":"8.2.29"},{"introduced":"8.3.0"},{"fixed":"8.3.23"},{"introduced":"8.4.0"},{"fixed":"8.4.10"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.33"},{"introduced":"8.2.0"},{"fixed":"8.2.29"},{"introduced":"8.3.0"},{"fixed":"8.3.23"},{"introduced":"8.4.0"},{"fixed":"8.4.10"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.33"},{"introduced":"8.2.0"},{"fixed":"8.2.29"},{"introduced":"8.3.0"},{"fixed":"8.3.23"},{"introduced":"8.4.0"},{"fixed":"8.4.10"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-6491 php7.4 Corrigé dans: 7.4.33-1+deb11u9
Références
- advisory github.com
- web nvd.nist.gov
- web openwall.com
- web lists.debian.org