| Package | php7.0 |
|---|---|
| Version | 7.0.33-0+deb9u25 (stretch) |
| Related CVEs | CVE-2025-14181 CVE-2026-6103 CVE-2026-91765 CVE-2026-91766 CVE-2026-91767 CVE-2026-91768 CVE-2026-91769 CVE-2026-92842 CVE-2026-93682 |
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language, which could result in in denial of service, information disclosure, privilege escalation, incorrect validation of TLS certificates or bypass of access control restrictions.
- CVE-2025-14181
-
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which may lead to denial of service or memory corruption depending on the heap layout and the compiler used to build PHP.
- CVE-2026-6103
-
An integer overflow vulnerability was discovered in
phar_tar_number(), which allows TAR archive entry injection. - CVE-2026-91765
-
The
cleanup_xml_node()function in the SOAP XML parser was found to recurse once per XML nesting level with no depth limit, which may allow denial of service via crafted SOAP request. - CVE-2026-91766
-
The
http://stream wrapper was found to leak credential upon redirects to another host/port or scheme downgrade, which may lead to information disclosure or privilege escalation. - CVE-2026-91767
-
Mohamed Sayed discovered that a client connecting over TLS to a server presenting a crafted wildcard CN could cause an out-of-bounds read of unbounded length during hostname verification, leading to denial of service.
- CVE-2026-91768
-
The IPv6 branch of the FastCGI client access check was found to compare only the first 12 bytes of a 16-byte IPv6 address, so
listen.allowed_clientsmaches on a /96 prefix instead of the exact address, which may lead to access control bypass by an attacker who can source an address sharing its first 96 bits with an allowed one. - CVE-2026-91769
-
TLS peer verification was found to violate RFC 6125, and falls back to Common Name validation after subjectAltName mismatch.
- CVE-2026-92842
-
A out-of-bounds read in the
convert.*stream filters when theline-break-charsoption containsNUL. - CVE-2026-93682
-
Ilia Alshanetsky discovered a out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header.
- GHSA-ch8v-r6jh-4vvr
-
Khashayar Fereidani discovered that
php_filter_encode_url()did not initialize the last entry of its 256-entry lookup table.
For Debian 9 stretch, these problems have been fixed in version 7.0.33-0+deb9u25.
We recommend that you upgrade your php7.0 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.