{"schemaVersion":3,"id":"USN-8336-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"php8.1, php8.3, php8.4, php8.5 vulnerabilities\n\nAleksey Solovev and Nikita Sveshnikov discovered that PHP improperly\nhandled NUL bytes when preparing SQL queries in the PDO Firebird driver. An\nattacker could possibly use this issue to perform SQL injection attacks.\n(CVE-2025-14179)\n\nIt was discovered that PHP incorrectly handled certain encoding names in\nmbstring. An attacker could possibly use this issue to obtain sensitive\ninformation or cause a denial of service. This issue only affected Ubuntu\n25.10 and Ubuntu 26.04 LTS. (CVE-2026-6104)\n\nIt was discovered that PHP incorrectly handled object references while\nparsing crafted SOAP requests. A remote attacker could possibly use this\nissue to execute arbitrary code. (CVE-2026-6722)\n\nIt was discovered that PHP incorrectly sanitized certain data in the\nPHP-FPM status page. A remote attacker could possibly use this issue to\ninject arbitrary JavaScript code. (CVE-2026-6735)\n\nIt was discovered that PHP had an encoding mismatch in mbstring. An\nattacker could possibly use this issue to cause PHP to crash, resulting in\na denial of service. (CVE-2026-7259)\n\nIt was discovered that PHP incorrectly handled SOAP session persistence\nafter errors. A remote attacker could possibly use this issue to obtain\nsensitive information or cause PHP to crash, resulting in a denial of\nservice. (CVE-2026-7261)\n\nIt was discovered that PHP incorrectly handled missing values in SOAP\ntypemap decoding. A remote attacker could possibly use this issue to cause\nPHP to crash, resulting in a denial of service. (CVE-2026-7262)\n\nIt was discovered that PHP incorrectly handled XML canonicalization in\nDOMNode::C14N(). An attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-7263)\n\nIt was discovered that PHP incorrectly handled very long input in\nmetaphone(). An attacker could possibly use this issue to cause PHP to\ncrash, resulting in a denial of service. (CVE-2026-7568)","dates":{"published":"2026-05-28T13:31:37.000Z","modified":"2026-06-30T18:16:42.311Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"php8.1","name":"php8.1","label":"php8.1","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php8.1","purlType":"deb","versions":[{"text":"< 8.1.2-1ubuntu2.24","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.1.2-1ubuntu2.24","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php8.3","name":"php8.3","label":"php8.3","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php8.3","purlType":"deb","versions":[{"text":"< 8.3.6-0ubuntu0.24.04.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.3.6-0ubuntu0.24.04.9","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php8.4","name":"php8.4","label":"php8.4","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php8.4","purlType":"deb","versions":[{"text":"< 8.4.11-1ubuntu1.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.4.11-1ubuntu1.2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php8.5","name":"php8.5","label":"php8.5","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php8.5","purlType":"deb","versions":[{"text":"< 8.5.4-0ubuntu1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.5.4-0ubuntu1.1","eol":null,"hubHref":null}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8336-1","label":"ubuntu.com/security/notices/USN-8336-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-14179","label":"ubuntu.com/security/CVE-2025-14179","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-6104","label":"ubuntu.com/security/CVE-2026-6104","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-6722","label":"ubuntu.com/security/CVE-2026-6722","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-6735","label":"ubuntu.com/security/CVE-2026-6735","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-7259","label":"ubuntu.com/security/CVE-2026-7259","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-7261","label":"ubuntu.com/security/CVE-2026-7261","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-7262","label":"ubuntu.com/security/CVE-2026-7262","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-7263","label":"ubuntu.com/security/CVE-2026-7263","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-7568","label":"ubuntu.com/security/CVE-2026-7568","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CVE-2025-14179","CVE-2026-6104","CVE-2026-6722","CVE-2026-6735","CVE-2026-7259","CVE-2026-7261","CVE-2026-7262","CVE-2026-7263","CVE-2026-7568"]},"timeline":[{"kind":"published","date":"2026-05-28T13:31:37.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-30T18:16:42.311Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T00:31:58.233Z","stale":false,"partial":false}}