--===============0379202510270789905==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature";
 boundary="x+6KMIRAuhnl3hBn"
Content-Disposition: inline


--x+6KMIRAuhnl3hBn
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-7400-1
March 31, 2025

php7.4, php8.1, php8.3 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in PHP.

Software Description:
- php8.3: HTML-embedded scripting language interpreter
- php8.1: HTML-embedded scripting language interpreter
- php7.4: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP incorrectly handle certain inputs.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. (CVE-2024-11235)

It was discovered that PHP incorrectly handle certain folded headers.
An attacker could possibly use this issue to cause a crash or
execute arbritrary code. (CVE-2025-1217)

It was discovered that PHP incorrectly handled certain headers.
An attacker could possibly use this issue to expose sensitive information
or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS
Ubuntu 24.10, and Ubuntu 24.04 LTS. (CVE-2025-1219)

It was discovered that PHP incorrectly handle certain headers with invalid
name and no colon. An attacker could possibly use this issue to confuse
applications into accepting invalid headers causing code injection.
(CVE-2025-1734)

It was discovered that PHP incorrectly handled certain headers.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.10, and Ubuntu 24.04
LTS. (CVE-2025-1736)

It was discovered that PHP incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive
information. (CVE-2025-1861)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
  libapache2-mod-php8.3           8.3.11-0ubuntu0.24.10.5
  php8.3                          8.3.11-0ubuntu0.24.10.5
  php8.3-cgi                      8.3.11-0ubuntu0.24.10.5
  php8.3-cli                      8.3.11-0ubuntu0.24.10.5
  php8.3-fpm                      8.3.11-0ubuntu0.24.10.5

Ubuntu 24.04 LTS
  libapache2-mod-php8.3           8.3.6-0ubuntu0.24.04.4
  php8.3                          8.3.6-0ubuntu0.24.04.4
  php8.3-cgi                      8.3.6-0ubuntu0.24.04.4
  php8.3-cli                      8.3.6-0ubuntu0.24.04.4
  php8.3-fpm                      8.3.6-0ubuntu0.24.04.4

Ubuntu 22.04 LTS
  libapache2-mod-php7.4           8.1.2-1ubuntu2.21
  libapache2-mod-php8.0           8.1.2-1ubuntu2.21
  libapache2-mod-php8.1           8.1.2-1ubuntu2.21
  php8.1                          8.1.2-1ubuntu2.21
  php8.1-cgi                      8.1.2-1ubuntu2.21
  php8.1-cli                      8.1.2-1ubuntu2.21
  php8.1-fpm                      8.1.2-1ubuntu2.21

Ubuntu 20.04 LTS
  libapache2-mod-php7.4           7.4.3-4ubuntu2.29
  php7.4                          7.4.3-4ubuntu2.29
  php7.4-cgi                      7.4.3-4ubuntu2.29
  php7.4-cli                      7.4.3-4ubuntu2.29
  php7.4-fpm                      7.4.3-4ubuntu2.29

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7400-1
  CVE-2024-11235, CVE-2025-1217, CVE-2025-1219, CVE-2025-1734,
  CVE-2025-1736, CVE-2025-1861

Package Information:
  https://launchpad.net/ubuntu/+source/php8.3/8.3.11-0ubuntu0.24.10.5
  https://launchpad.net/ubuntu/+source/php8.3/8.3.6-0ubuntu0.24.04.4
  https://launchpad.net/ubuntu/+source/php8.1/8.1.2-1ubuntu2.21
  https://launchpad.net/ubuntu/+source/php7.4/7.4.3-4ubuntu2.29


--x+6KMIRAuhnl3hBn
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEf+ebRFcoyOoAQoOeRbznW4QLH2kFAmfrFzAACgkQRbznW4QL
H2mDxQ//Sf3lQ014epOMBqUDUvxg7SJjIlnUzHskzB9tRKirKdJJ48aeshzNLjAD
Vba+FhLQWMI5GhVl8WYiuelh/sD6/jAEoCsbNZQW6cMB1aYkpnjTu2udtJis32z+
Lallp1oT7AZFHHuoflkvl8gwG/rLyBOOHt+NLeZKQ+fua4apTeBSIxUcooG9IGIN
s8azOZBcG4qL5pp38yb8xk3mO81C/As3gVwWgOZMnHQSzFmHSbACJkqvkiHiqPPP
bmrjQozC1teI3jzH/F6EgqDqTDvneMVyngxqpdf9Ne7EVFFIlNQsE7zmMtJt+SFv
vJ+vnwdffbrFmmn/k9smJXSOsrEztuw6Vr++RJ+Cq+BaV+N+1MfP+ei1/8lBfkNr
wUx0O/zQAJS02bzud/1GbSV2uqPVn94eLnsUMUgLUS3FYkme4/WuIYFT9lrj14Cl
LnzEe0AQ+pgeEyUnbekgX3u0jq3HuCiqzJj/U3sMeSdXkoepwQdZ9rPvzUcylJjN
sj5ID10F/8fLdJIVEmh+kd7aabq/cE8Gu6dzFinh87XY0/gZIqetdHUBbT9QqIl2
Fcj5yIY8ZgNh7NOLC7Ckd3NIFuERldZOwDaqPFw2PftyFQ4HzlSD4K3tH9SweV78
Vo2J/Dg4P95t5JljfBeejwIDE5PXTVhCUtzAZakJ7MT8OxTZeRs=
=3y92
-----END PGP SIGNATURE-----

--x+6KMIRAuhnl3hBn--


--===============0379202510270789905==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline


--===============0379202510270789905==--