| Package | php7.3 |
|---|---|
| Version | 7.3.31-1~deb10u15 (buster) |
| Related CVEs | CVE-2025-1218 CVE-2025-14181 CVE-2026-6103 CVE-2026-91765 CVE-2026-91766 CVE-2026-91767 CVE-2026-91768 CVE-2026-91769 CVE-2026-92842 CVE-2026-93682 |
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language, which could result in in denial of service, information disclosure, privilege escalation, incorrect validation of TLS certificates or bypass of access control restrictions.
- CVE-2025-1218
-
Various packet overreads in were found in the mysqlnd wire protocol, which may lead to denial of service when connecting to an untrusted or compromised MySQL server. Applications that only connect to trusted database servers are not exposed.
- CVE-2025-14181
-
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which may lead to denial of service or memory corruption depending on the heap layout and the compiler used to build PHP.
- CVE-2026-6103
-
An integer overflow vulnerability was discovered in
phar_tar_number(), which allows TAR archive entry injection. - CVE-2026-91765
-
The
cleanup_xml_node()function in the SOAP XML parser was found to recurse once per XML nesting level with no depth limit, which may allow denial of service via crafted SOAP request. - CVE-2026-91766
-
The
http://stream wrapper was found to leak credential upon redirects to another host/port or scheme downgrade, which may lead to information disclosure or privilege escalation. - CVE-2026-91767
-
Mohamed Sayed discovered that a client connecting over TLS to a server presenting a crafted wildcard CN could cause an out-of-bounds read of unbounded length during hostname verification, leading to denial of service.
- CVE-2026-91768
-
The IPv6 branch of the FastCGI client access check was found to compare only the first 12 bytes of a 16-byte IPv6 address, so
listen.allowed_clientsmaches on a /96 prefix instead of the exact address, which may lead to access control bypass by an attacker who can source an address sharing its first 96 bits with an allowed one. - CVE-2026-91769
-
TLS peer verification was found to violate RFC 6125, and falls back to Common Name validation after subjectAltName mismatch.
- CVE-2026-92842
-
A out-of-bounds read in the
convert.*stream filters when theline-break-charsoption containsNUL. - CVE-2026-93682
-
Ilia Alshanetsky discovered a out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header.
- GHSA-ch8v-r6jh-4vvr
-
Khashayar Fereidani discovered that
php_filter_encode_url()did not initialize the last entry of its 256-entry lookup table.
For Debian 10 buster, these problems have been fixed in version 7.3.31-1~deb10u15.
We recommend that you upgrade your php7.3 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.