BSD Portsphp -- Multiple vulnerabilities
· CVE-2025-1735, CVE-2025-6491, CVE-2025-1220 · VuXML entry
php.net reports: CVE-2025-1735: pgsql extension does not check for errors during escaping CVE-2025-6491: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix CVE-2025-1220: Null byte termination in hostnames
Affected versions
- php81 < 8.1.33
- php82 < 8.2.29
- php83 < 8.3.23
- php84 < 8.4.10
By system
4 still vulnerable, 3 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | lang/php81 | 8.1.32 | vulnerable since 2025-07-03 | |
| DragonFly | lang/php82 | 8.2.28 | vulnerable since 2025-07-03 | |
| NetBSD | lang/php82 | 8.2.33nb1 | not listed | |
| MidnightBSD | lang/php82 | 8.2.35 | out of range, by version | |
| FreeBSD | lang/php82 | 8.2.35_2 | fixed | (366 days after) |
| DragonFly | lang/php83 | 8.3.21 | vulnerable since 2025-07-03 | |
| NetBSD | lang/php83 | 8.3.33nb1 | not listed | |
| MidnightBSD | lang/php83 | 8.3.36 | out of range, by version | |
| FreeBSD | lang/php83 | 8.3.36_2 | fixed | (366 days after) |
| DragonFly | lang/php84 | 8.4.8 | vulnerable since 2025-07-03 | |
| NetBSD | lang/php84 | 8.4.25nb1 | not listed | |
| MidnightBSD | lang/php84 | 8.4.27 | out of range, by version | |
| FreeBSD | lang/php84 | 8.4.27_2 | fixed | (366 days after) |