Detections
Analytics

Alpine: multiple php84 packages: security update to 8.4.27-r0

critical Tenable Cloud Security Plugin ID 476508

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,
 when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across
 requests via session storage. However, in the case SOAP requests results in an error, the persistance is
 handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-
 after-free. This may lead to memory corruption, information disclosure, or process crashes, with
 confidentiality, integrity, and availability impact on the vulnerable system. (CVE-2026-7261)

 - The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still
 holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make
 the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
 (CVE-2025-1218)

 - The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer
 overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away,
 a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes
 into it, producing a heap buffer overflow. (CVE-2025-14181)

 - phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The
 field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently
 wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file
 content as the next TAR header, which lets a crafted archive inject entries that PharData reports and
 extracts as if they were genuine. (CVE-2026-6103)

 - In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded
 NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes
 that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-
 bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected
 functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and
 mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.
 (CVE-2026-6104)

Solution

Update the php84 library and its related packages to version 8.4.27-r0 or later.

See Also

https://security.alpinelinux.org/vuln/CVE-2025-1218

https://security.alpinelinux.org/vuln/CVE-2025-14181

https://security.alpinelinux.org/vuln/CVE-2026-109618

https://security.alpinelinux.org/vuln/CVE-2026-109619

https://security.alpinelinux.org/vuln/CVE-2026-14355

https://security.alpinelinux.org/vuln/CVE-2026-17543

https://security.alpinelinux.org/vuln/CVE-2026-17544

https://security.alpinelinux.org/vuln/CVE-2026-29078

https://security.alpinelinux.org/vuln/CVE-2026-29079

https://security.alpinelinux.org/vuln/CVE-2026-6103

https://security.alpinelinux.org/vuln/CVE-2026-6104

https://security.alpinelinux.org/vuln/CVE-2026-6722

https://security.alpinelinux.org/vuln/CVE-2026-6735

https://security.alpinelinux.org/vuln/CVE-2026-7258

https://security.alpinelinux.org/vuln/CVE-2026-7259

https://security.alpinelinux.org/vuln/CVE-2026-7260

https://security.alpinelinux.org/vuln/CVE-2026-7261

https://security.alpinelinux.org/vuln/CVE-2026-7262

https://security.alpinelinux.org/vuln/CVE-2026-7263

https://security.alpinelinux.org/vuln/CVE-2026-7568

https://security.alpinelinux.org/vuln/CVE-2026-91765

https://security.alpinelinux.org/vuln/CVE-2026-91766

https://security.alpinelinux.org/vuln/CVE-2026-91767

https://security.alpinelinux.org/vuln/CVE-2026-91768

https://security.alpinelinux.org/vuln/CVE-2026-91769

https://security.alpinelinux.org/vuln/CVE-2026-92842

https://security.alpinelinux.org/vuln/CVE-2026-93682

https://security.alpinelinux.org/vuln/CVE-2026-9672

Plugin Details

Severity: Critical

ID: 476508

Version: Revision 1.6

Type: Local

Published: 10/21/2026

Updated: 11/5/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Critical

Score: 9.5

Percentile: 99.88

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-7261

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.5

Threat Score: 9.5

Threat Vector: CVSS:4.0/E:A

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS Score Source: CVE-2026-6722

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 3/13/2026

Exploitable With

Core Impact

Reference Information

CVE: CVE-2025-1218, CVE-2025-14181, CVE-2026-109618, CVE-2026-109619, CVE-2026-14355, CVE-2026-17543, CVE-2026-17544, CVE-2026-29078, CVE-2026-29079, CVE-2026-6103, CVE-2026-6104, CVE-2026-6722, CVE-2026-6735, CVE-2026-7258, CVE-2026-7259, CVE-2026-7260, CVE-2026-7261, CVE-2026-7262, CVE-2026-7263, CVE-2026-7568, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682, CVE-2026-9672

IAVA: 2026-A-0440, 2026-A-0660-S, 2026-A-0814, 2026-A-1074-S, 2026-A-1141