Ubuntu 16.04 LTS / 18.04 LTS : PHP vulnerabilities (USN-7645-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7645-1 advisory. It was discovered that PHP incorrectly parsed certain HTTP response headers. An attacker could possibly use this issue to cause incorrect MIM...

USN-7645-1 php7.0, php7.2 vulnerabilities

It was discovered that PHP incorrectly parsed certain HTTP response headers. An attacker could possibly use this issue to cause incorrect MIME type parsing which could result in unexpected behavior. CVE-2025-1217 It was discovered that PHP did not properly validate certain HTTP headers. An attack...

USN-7645-1: PHP vulnerabilities

It was discovered that PHP incorrectly parsed certain HTTP response headers. An attacker could possibly use this issue to cause incorrect MIME type parsing which could result in unexpected behavior. CVE-2025-1217 It was discovered that PHP did not properly validate certain HTTP headers. An attack...

CVE-2025-3859

Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into thinking they were on a different webpage. This vulnerability was fixed in Focus 138...

User Interface (UI) Misrepresentation of Critical Information

Overview mozilla-mobile/firefox-ios is a The source code and project files for the Firefox Focus application on the iOS platform. Affected versions of this package are vulnerable to User Interface UI Misrepresentation of Critical Information due to the truncating behavior in the location view. An...

CVE-2025-3859

Summary: CVE-2025-3859 affects Mozilla Firefox Focus for iOS (pre-138 builds). The vulnerability arises from a long URL truncation/eliding behavior in the address/location bar, which can mislead users into thinking they are on a different webpage. This is tied to the Firefox Focus/iOS truncation ...

Mozilla Firefox Focus 安全漏洞

Mozilla Firefox Focus is an American browser from the Mozilla Foundation for iOS devices. A security vulnerability exists in Mozilla Firefox Focus prior to version 138, which stems from a long URL truncation behavior that could cause users to be misdirected to a different web page...

Azure Linux 3.0 Security Update: php (CVE-2025-1861)

The version of php installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-1861 advisory. - In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when...

CVE-2025-1861

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC911...

CVE-2025-1861 Stream HTTP wrapper truncates redirect location to 1024 bytes

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC911...

CVE-2025-1861

CVE-2025-1861 affects PHP across multiple branches (8.1.x up to 8.1.32, 8.2.x up to 8.2.28, 8.3.x up to 8.3.19, 8.4.x up to 8.4.5). Root cause: the HTTP redirect location is truncated due to a 1024-byte location buffer during redirect handling. Impact: redirects may resolve to an incorrect URL, p...

CVE-2025-1861

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC911...

CVE-2025-1861

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC911...

Astra Linux – Vulnerability in Firefox and Thunderbird

The truncation of a long URL could have allowed for origin spoofing in a permission prompt. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132...

PT-2025-11347

Vulnerability Report Name of the Vulnerable Software and Affected Versions PHP versions 8.1.0 through 8.1.31 PHP versions 8.2.0 through 8.2.27 PHP versions 8.3.0 through 8.3.18 PHP versions 8.4.0 through 8.4.4 PHP 7.4 Debian Description PHP is an HTML-embedded scripting language commonly used wit...

firefox: thunderbird: Origin of permission prompt could be spoofed by long URL

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the following issue: Truncation of a long URL could have allowed origin spoofing in a permission prompt...

firefox: thunderbird: Origin of permission prompt could be spoofed by long URL

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the following issue: Truncation of a long URL could have allowed origin spoofing in a permission prompt...

firefox: thunderbird: Origin of permission prompt could be spoofed by long URL

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the following issue: Truncation of a long URL could have allowed origin spoofing in a permission prompt...

firefox: thunderbird: Origin of permission prompt could be spoofed by long URL

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the following issue: Truncation of a long URL could have allowed origin spoofing in a permission prompt...

firefox: thunderbird: Origin of permission prompt could be spoofed by long URL

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the following issue: Truncation of a long URL could have allowed origin spoofing in a permission prompt...