Memory leak in PHP - CVE-2025-14177

Vulnerability identifier: #VU120272

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-14177

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in getimagesize. A remote attacker can force the application to leak memory and perform denial of service attack.

PHP
Debian Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Web and Scripting Module
openSUSE Leap
Ubuntu
openEuler
SecurityCenter
libzip
libzip-devel
libzip-tools
php-pear
php-pecl-zip
php-pecl-rrd
php-pecl-xdebug
php-pecl-apcu
apcu-panel
php-pecl-apcu-devel
php7.2 (Ubuntu package)
php-intl
php
php-bcmath
php-cli
php-common
php-dba
php-dbg
php-devel
php-embedded
php-enchant
php-ffi
php-gd
php-xmlrpc
php-xml
php-soap
php-snmp
php-process
php-pgsql
php-pdo
php-opcache
php-odbc
php-mysqlnd
php-mbstring
php-ldap
php-json
php-gmp
php-fpm
php (Red Hat package)
php-help
php-debuginfo
php-debugsource
php-sodium
php-tidy
php8.2 (Debian package)
php8-shmop-debuginfo
php8-sysvsem
php8-ftp-debuginfo
php8-readline-debuginfo
php8-xmlwriter-debuginfo
php8-pgsql
php8-fileinfo-debuginfo
php8-sysvshm
php8-dba
php8-mysql
php8-soap-debuginfo
php8-fastcgi-debuginfo
php8-iconv
php8-iconv-debuginfo
php8-fpm-apache
apache2-mod_php8-debuginfo
php8-pdo
php8-gettext-debuginfo
php8-exif-debuginfo
php8-ldap-debuginfo
php8-calendar-debuginfo
php8-ctype-debuginfo
php8-test
php8-gettext
php8-zip-debuginfo
php8-sockets
php8-embed-debuginfo
php8-sqlite
php8-devel
php8-pgsql-debuginfo
php8-posix-debuginfo
php8-odbc
php8-sodium-debuginfo
php8-bz2-debuginfo
php8-debuginfo
php8-sysvmsg-debuginfo
php8-openssl-debuginfo
php8-snmp
php8-mbstring
php8-mbstring-debuginfo
php8-fpm-debugsource
php8-sockets-debuginfo
php8-fileinfo
php8-cli-debuginfo
php8-opcache
php8-dba-debuginfo
php8-tokenizer
php8-xmlreader
php8-posix
php8-embed
php8-embed-debugsource
php8-gmp
php8-sysvshm-debuginfo
php8-odbc-debuginfo
php8-xsl
php8-sodium
php8-phar
php8-xmlwriter
php8-tokenizer-debuginfo
php8-zlib-debuginfo
php8-sysvmsg
php8-sqlite-debuginfo
php8-dom-debuginfo
php8-intl
php8-xmlreader-debuginfo
php8-zip
php8-fastcgi
php8-readline
php8-bcmath-debuginfo
php8-phar-debuginfo
php8-curl-debuginfo
php8-pcntl-debuginfo
php8-xsl-debuginfo
php8-calendar
php8-fpm
php8-ldap
php8-gd-debuginfo
php8-mysql-debuginfo
php8-snmp-debuginfo
php8-ffi
php8-ctype
php8-bz2
php8-tidy
php8-intl-debuginfo
php8-debugsource
php8-zlib
php8-pcntl
apache2-mod_php8
php8-gd
php8-bcmath
php8-shmop
php8-dom
php8-pdo-debuginfo
php8-ffi-debuginfo
php8-gmp-debuginfo
php8-sysvsem-debuginfo
php8
apache2-mod_php8-debugsource
php8-cli
php8-openssl
php8-enchant-debuginfo
php8-fpm-debuginfo
php8-ftp
php8-fastcgi-debugsource
php8-opcache-debuginfo
php8-exif
php8-tidy-debuginfo
php8-curl
php8-soap
php8-enchant
php8.4 (Debian package)

Install updates from vendor's website.

PHP - addressed in versions 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1
SecurityCenter - addressed in versions SC-202602.1, SC-202602.2
libzip - update to 1.6.1-1
libzip-devel - update to 1.6.1-1
libzip-tools - update to 1.6.1-1
php-pear - update to 1.10.13-1.0.1
php-pecl-zip - update to 1.18.2-1
php-pecl-rrd - update to 2.0.1-1
php-pecl-xdebug - update to 2.9.5-1
php-pecl-apcu - update to 5.1.18-1
apcu-panel - update to 5.1.18-1
php-pecl-apcu-devel - update to 5.1.18-1
php7.2 (Ubuntu package) - addressed in versions 7.2.24-0ubuntu0.18.04.17+esm12, 7.4.3-4ubuntu2.29+esm3, 8.1.2-1ubuntu2.23, 8.3.6-0ubuntu0.24.04.6, 8.4.5-1ubuntu1.2, 8.4.11-1ubuntu1.1
php-intl - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-bcmath - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-cli - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-common - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-dba - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-dbg - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-devel - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-embedded - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-enchant - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-ffi - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-gd - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-xmlrpc - update to 7.4.33-3.0.1
php-xml - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-soap - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-snmp - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-process - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-pgsql - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-pdo - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-opcache - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-odbc - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-mysqlnd - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-mbstring - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-ldap - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-json - update to 7.4.33-3.0.1
php-gmp - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php-fpm - addressed in versions 7.4.33-3.0.1, 8.3.29-1
php (Red Hat package) - addressed in versions 8.0.30-5.el9_7, 8.3.29-1.el10_1
php-cli - addressed in versions 8.0.30-11, 8.3.29-1
php-bcmath - addressed in versions 8.0.30-11, 8.3.29-1
php-dbg - addressed in versions 8.0.30-11, 8.3.29-1
php-common - addressed in versions 8.0.30-11, 8.3.29-1
php-dba - addressed in versions 8.0.30-11, 8.3.29-1
php-process - addressed in versions 8.0.30-11, 8.3.29-1
php - addressed in versions 8.0.30-11, 8.3.29-1
php-help - addressed in versions 8.0.30-11, 8.3.29-1
php-xml - addressed in versions 8.0.30-11, 8.3.29-1
php-soap - addressed in versions 8.0.30-11, 8.3.29-1
php-snmp - addressed in versions 8.0.30-11, 8.3.29-1
php-debuginfo - addressed in versions 8.0.30-11, 8.3.29-1
php-debugsource - addressed in versions 8.0.30-11, 8.3.29-1
php-devel - addressed in versions 8.0.30-11, 8.3.29-1
php-embedded - addressed in versions 8.0.30-11, 8.3.29-1
php-enchant - addressed in versions 8.0.30-11, 8.3.29-1
php-ffi - addressed in versions 8.0.30-11, 8.3.29-1
php-fpm - addressed in versions 8.0.30-11, 8.3.29-1
php-gd - addressed in versions 8.0.30-11, 8.3.29-1
php-gmp - addressed in versions 8.0.30-11, 8.3.29-1
php-intl - addressed in versions 8.0.30-11, 8.3.29-1
php-ldap - addressed in versions 8.0.30-11, 8.3.29-1
php-pgsql - addressed in versions 8.0.30-11, 8.3.29-1
php-mbstring - addressed in versions 8.0.30-11, 8.3.29-1
php-mysqlnd - addressed in versions 8.0.30-11, 8.3.29-1
php-odbc - addressed in versions 8.0.30-11, 8.3.29-1
php-opcache - addressed in versions 8.0.30-11, 8.3.29-1
php-pdo - addressed in versions 8.0.30-11, 8.3.29-1
php-sodium - addressed in versions 8.0.30-11, 8.3.29-1
php-tidy - addressed in versions 8.0.30-11, 8.3.29-1
php8.2 (Debian package) - update to 8.2.30-1~deb12u1
php8-shmop-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-sysvsem - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-ftp-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-readline-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-xmlwriter-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-pgsql - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-fileinfo-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-sysvshm - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-dba - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-mysql - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-soap-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-fastcgi-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-iconv - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-iconv-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-fpm-apache - update to 8.2.30-150600.3.25.1
apache2-mod_php8-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-pdo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-gettext-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-exif-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-ldap-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-calendar-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-ctype-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-test - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-gettext - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-zip-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-sockets - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-embed-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-sqlite - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-devel - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-pgsql-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-posix-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-odbc - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-sodium-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-bz2-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-sysvmsg-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-openssl-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-snmp - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-mbstring - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-mbstring-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-fpm-debugsource - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-sockets-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-fileinfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-cli-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-opcache - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-dba-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-tokenizer - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-xmlreader - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-posix - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-embed - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-embed-debugsource - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-gmp - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-sysvshm-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-odbc-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-xsl - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-sodium - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-phar - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-xmlwriter - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-tokenizer-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-zlib-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-sysvmsg - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-sqlite-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-dom-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-intl - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-xmlreader-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-zip - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-fastcgi - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-readline - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-bcmath-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-phar-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-curl-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-pcntl-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-xsl-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-calendar - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-fpm - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-ldap - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-gd-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-mysql-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-snmp-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-ffi - update to 8.2.30-150600.3.25.1
php8-ctype - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-bz2 - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-tidy - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-intl-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-debugsource - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-zlib - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-pcntl - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
apache2-mod_php8 - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-gd - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-bcmath - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-shmop - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-dom - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-pdo-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-ffi-debuginfo - update to 8.2.30-150600.3.25.1
php8-gmp-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-sysvsem-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8 - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
apache2-mod_php8-debugsource - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-cli - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-openssl - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-enchant-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-fpm-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-ftp - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-fastcgi-debugsource - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-opcache-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-exif - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-tidy-debuginfo - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-curl - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-soap - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php8-enchant - addressed in versions 8.2.30-150600.3.25.1, 8.3.23-150700.3.6.1, 8.3.29-150700.3.9.1
php-sodium - update to 8.3.29-1
php8.4 (Debian package) - update to 8.4.16-1~deb13u1

• Exploit #12736 - CVE-2025-14177 (PHP getimagesize() CVE-2025-14177 - Heap Memory Leak Exploit Generator Fully functional exploit chain in Python) (May 22, 2026)

• https://www.php.net/ChangeLog-8.php#8.5.1
• https://www.php.net/ChangeLog-8.php#8.3.29
• https://www.php.net/ChangeLog-8.php#8.2.30
• https://www.php.net/ChangeLog-8.php#8.4.16
• https://www.php.net/ChangeLog-8.php#8.1.34
• https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7

• Multiple vulnerabilities in PHP
• Debian update for php8.4
• SUSE update for php8
• SUSE update for php8
• openEuler 20.03 LTS SP4 update for php
• openEuler 24.03 LTS SP3 update for php
• openEuler 24.03 LTS SP2 update for php
• openEuler 24.03 LTS SP1 update for php
• openEuler 24.03 LTS update for php
• openEuler 22.03 LTS SP4 update for php
• openEuler 22.03 LTS SP3 update for php
• SUSE update for php8
• Ubuntu update for php7.2
• Red Hat Enterprise Linux 9 update for the php:8.3 module
• Red Hat Enterprise Linux 9 update for the php:8.2 module
• Red Hat Enterprise Linux 8 update for the php:8.2 module
• Red Hat Enterprise Linux 10 update for php
• Anolis OS update for php
• Red Hat Enterprise Linux 8 update for the php:7.4 module
• Red Hat Enterprise Linux 9 update for php
• Multiple vulnerabilities in Tenable Security Center
• Anolis OS update for php:7.4 module
• Debian update for php8.2