BSD Portsphp -- Multiple vulnerabilities
· CVE-2024-11235, CVE-2025-1219, CVE-2025-1736, CVE-2025-1861, CVE-2025-1734, CVE-2025-1217 · VuXML entry
php.net reports: CVE-2024-11235: Core: Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). CVE-2025-1219: LibXML: Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). CVE-2025-1736: Streams: Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). CVE-2025-1861: Streams: Fixed …
Affected versions
- php81 < 8.1.32
- php82 < 8.2.28
- php83 < 8.3.19
- php84 < 8.4.5
By system
0 still vulnerable, 7 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | lang/php81 | 8.1.32 | fixed | |
| DragonFly | lang/php82 | 8.2.28 | fixed | |
| NetBSD | lang/php82 | 8.2.33nb1 | not listed | |
| MidnightBSD | lang/php82 | 8.2.35 | out of range, by version | |
| FreeBSD | lang/php82 | 8.2.35_2 | fixed | (478 days after) |
| DragonFly | lang/php83 | 8.3.21 | fixed | |
| NetBSD | lang/php83 | 8.3.33nb1 | not listed | |
| MidnightBSD | lang/php83 | 8.3.36 | out of range, by version | |
| FreeBSD | lang/php83 | 8.3.36_2 | fixed | (478 days after) |
| DragonFly | lang/php84 | 8.4.8 | fixed | |
| NetBSD | lang/php84 | 8.4.25nb1 | not listed | |
| MidnightBSD | lang/php84 | 8.4.27 | out of range, by version | |
| FreeBSD | lang/php84 | 8.4.27_2 | fixed | (478 days after) |