🛡️ ALSA-2025:15687 — apcu-panel (CVE-2024-8929 +7 more)

⚪ Unknown ✅ No Known Exploit OSV

N/A

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

Moderate: php:8.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)
php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)
php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)
php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)
php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)
php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)
php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)
php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected software

ALSA-2025:15687 is recorded against 35 packages.

apcu-panel (fixed in 5.1.23-1.module_el8.10.0+3796+30ed3ef7)
libzip (fixed in 1.7.3-1.module_el8.10.0+3796+30ed3ef7)
libzip-devel (fixed in 1.7.3-1.module_el8.10.0+3796+30ed3ef7)
libzip-tools (fixed in 1.7.3-1.module_el8.10.0+3796+30ed3ef7)
php (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-bcmath (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-cli (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-common (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-dba (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-dbg (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-devel (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-embedded (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-enchant (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-ffi (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-fpm (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-gd (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-gmp (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-intl (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-ldap (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-mbstring (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-mysqlnd (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-odbc (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-opcache (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-pdo (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)

Show the remaining 11 packages

php-pear (fixed in 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7)
php-pecl-apcu (fixed in 5.1.23-1.module_el8.10.0+3796+30ed3ef7)
php-pecl-apcu-devel (fixed in 5.1.23-1.module_el8.10.0+3796+30ed3ef7)
php-pecl-rrd (fixed in 2.0.3-1.module_el8.10.0+3796+30ed3ef7)
php-pecl-xdebug3 (fixed in 3.2.2-2.module_el8.10.0+3796+30ed3ef7)
php-pecl-zip (fixed in 1.22.3-1.module_el8.10.0+3796+30ed3ef7)
php-pgsql (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-process (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-snmp (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-soap (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)
php-xml (fixed in 8.2.28-1.module_el8.10.0+4046+958a243a)

Timeline and source

Published on 11 September 2025 and last revised on 4 February 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

Other advisories for this package

apcu-panel has other advisories on record. If you are patching this one, these are worth checking on the same host:

RHSA-2026:34354 (published 2 Jul 2026)
ALSA-2026:34354 (published 1 Jul 2026)
RHSA-2026:22305 (published 2 Jun 2026)
ALSA-2026:22143 (published 1 Jun 2026)
RHSA-2026:22142 (published 1 Jun 2026)
ALSA-2026:22142 (published 1 Jun 2026)
ALSA-2026:22305 (published 1 Jun 2026)
RHSA-2026:22143 (published 1 Jun 2026)

Details

Severity Unknown

CVSS Score N/A

CVSS Vector N/A

CWE N/A

Public Exploit ✅ No

Source OSV

Published 2025-09-11

Updated 2026-08-20

Modified 2026-02-04

Fix URL N/A

Affected Packages

Software	From version	Fixed in
apcu-panel	—	5.1.23-1.module_el8.10.0+3796+30ed3ef7
libzip	—	1.7.3-1.module_el8.10.0+3796+30ed3ef7
libzip-devel	—	1.7.3-1.module_el8.10.0+3796+30ed3ef7
libzip-tools	—	1.7.3-1.module_el8.10.0+3796+30ed3ef7
php	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-bcmath	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-cli	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-common	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-dba	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-dbg	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-devel	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-embedded	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-enchant	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-ffi	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-fpm	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-gd	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-gmp	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-intl	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-ldap	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-mbstring	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-mysqlnd	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-odbc	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-opcache	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-pdo	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-pear	—	1:1.10.14-1.module_el8.10.0+3796+30ed3ef7
php-pecl-apcu	—	5.1.23-1.module_el8.10.0+3796+30ed3ef7
php-pecl-apcu-devel	—	5.1.23-1.module_el8.10.0+3796+30ed3ef7
php-pecl-rrd	—	2.0.3-1.module_el8.10.0+3796+30ed3ef7
php-pecl-xdebug3	—	3.2.2-2.module_el8.10.0+3796+30ed3ef7
php-pecl-zip	—	1.22.3-1.module_el8.10.0+3796+30ed3ef7
php-pgsql	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-process	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-snmp	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-soap	—	8.2.28-1.module_el8.10.0+4046+958a243a
php-xml	—	8.2.28-1.module_el8.10.0+4046+958a243a

References

ADVISORY https://access.redhat.com/errata/RHSA-2025:15687

REPORT https://access.redhat.com/security/cve/CVE-2024-11233

REPORT https://access.redhat.com/security/cve/CVE-2024-11234

REPORT https://access.redhat.com/security/cve/CVE-2024-8929

REPORT https://access.redhat.com/security/cve/CVE-2025-1217

REPORT https://access.redhat.com/security/cve/CVE-2025-1219

REPORT https://access.redhat.com/security/cve/CVE-2025-1734

REPORT https://access.redhat.com/security/cve/CVE-2025-1736

REPORT https://access.redhat.com/security/cve/CVE-2025-1861

REPORT https://bugzilla.redhat.com/2327960

REPORT https://bugzilla.redhat.com/2328521

REPORT https://bugzilla.redhat.com/2328523

REPORT https://bugzilla.redhat.com/2355917

REPORT https://bugzilla.redhat.com/2356041

REPORT https://bugzilla.redhat.com/2356042

REPORT https://bugzilla.redhat.com/2356043

REPORT https://bugzilla.redhat.com/2356046

ADVISORY https://errata.almalinux.org/8/ALSA-2025-15687.html

🔗 NVD 🔗 Mitre

Similar Threats

Free Vulnerability Check

Is your site affected by ALSA-2025:15687?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against ALSA-2025:15687 and other known CVE records.

Scan My Site Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

🛡️ ALSA-2025:15687 — apcu-panel (CVE-2024-8929 +7 more)

Description

Affected software

Timeline and source

References

Other advisories for this package

Is your site affected by ALSA-2025:15687?

Browse related advisories

Company

Resources

Services

Trusted

Subscribe