Debian dla-4819 : libapache2-mod-php8.2 - security update

medium Nessus Plugin ID 362914

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4819 advisory.

------------------------------------------------------------------------- Debian LTS Advisory DLA-4819-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin October 05, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : php8.2 Version : 8.2.34-1~deb12u1 CVE ID : CVE-2025-1218 CVE-2025-14181 CVE-2026-6103 CVE-2026-91765 CVE-2026-91766 CVE-2026-91767 CVE-2026-91768 CVE-2026-91769 CVE-2026-92842 CVE-2026-93682

Multiple security issues were found in PHP, a widely-used open source general purpose scripting language, which could result in in denial of service, information disclosure, privilege escalation, incorrect validation of TLS certificates or bypass of access control restrictions.

CVE-2025-1218

Various packet overreads in were found in the mysqlnd wire protocol, which may lead to denial of service when connecting to an untrusted or compromised MySQL server. Applications that only connect to trusted database servers are not exposed.

CVE-2025-14181

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which may lead to denial of service or memory corruption depending on the heap layout and the compiler used to build PHP.

CVE-2026-6103

An integer overflow vulnerability was discovered in phar_tar_number(), which allows TAR archive entry injection.

CVE-2026-91765

The cleanup_xml_node() function in the SOAP XML parser was found to recurse once per XML nesting level with no depth limit, which may allow denial of service via crafted SOAP request.

CVE-2026-91766

The http:// stream wrapper was found to leak credential upon redirects to another host/port or scheme downgrade, which may lead to information disclosure or privilege escalation.

CVE-2026-91767

Mohamed Sayed discovered that a client connecting over TLS to a server presenting a crafted wildcard CN could cause an out-of-bounds read of unbounded length during hostname verification, leading to denial of service.

CVE-2026-91768

The IPv6 branch of the FastCGI client access check was found to compare only the first 12 bytes of a 16-byte IPv6 address, so `listen.allowed_clients` maches on a /96 prefix instead of the exact address, which may lead to access control bypass by an attacker who can source an address sharing its first 96 bits with an allowed one.

CVE-2026-91769

TLS peer verification was found to violate RFC 6125, and falls back to Common Name validation after subjectAltName mismatch.

CVE-2026-92842

A out-of-bounds read in the convert.* stream filters when the `line-break-chars` option contains NUL.

CVE-2026-93682

Ilia Alshanetsky discovered a out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header.

GHSA-ch8v-r6jh-4vvr

Khashayar Fereidani discovered that php_filter_encode_url() did not initialize the last entry of its 256-entry lookup table.

For Debian 12 bookworm, these problems have been fixed in version 8.2.34-1~deb12u1.

We recommend that you upgrade your php8.2 packages.

For the detailed security status of php8.2 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/php8.2

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Attachment:
signature.asc Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the libapache2-mod-php8.2 packages.

Plugin Details

Severity: Medium

ID: 362914

File Name: debian_DLA-4819.nasl

Version: 1.3

Type: Local

Agent: unix

Family: Debian Local Security Checks

Published: 10/4/2026

Updated: 10/26/2026

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.46

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.2

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-91766

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:libapache2-mod-php8.2, p-cpe:/a:debian:debian_linux:libphp8.2-embed, p-cpe:/a:debian:debian_linux:php8.2-bcmath, p-cpe:/a:debian:debian_linux:php8.2-bz2, p-cpe:/a:debian:debian_linux:php8.2-cgi, p-cpe:/a:debian:debian_linux:php8.2-cli, p-cpe:/a:debian:debian_linux:php8.2-common, p-cpe:/a:debian:debian_linux:php8.2-curl, p-cpe:/a:debian:debian_linux:php8.2-dba, p-cpe:/a:debian:debian_linux:php8.2-dev, p-cpe:/a:debian:debian_linux:php8.2-enchant, p-cpe:/a:debian:debian_linux:php8.2-fpm, p-cpe:/a:debian:debian_linux:php8.2-gd, p-cpe:/a:debian:debian_linux:php8.2-gmp, p-cpe:/a:debian:debian_linux:php8.2-imap, p-cpe:/a:debian:debian_linux:php8.2-interbase, p-cpe:/a:debian:debian_linux:php8.2-intl, p-cpe:/a:debian:debian_linux:php8.2-ldap, p-cpe:/a:debian:debian_linux:php8.2-mbstring, p-cpe:/a:debian:debian_linux:php8.2-mysql, p-cpe:/a:debian:debian_linux:php8.2-odbc, p-cpe:/a:debian:debian_linux:php8.2-opcache, p-cpe:/a:debian:debian_linux:php8.2-pgsql, p-cpe:/a:debian:debian_linux:php8.2-phpdbg, p-cpe:/a:debian:debian_linux:php8.2-pspell, p-cpe:/a:debian:debian_linux:php8.2-readline, p-cpe:/a:debian:debian_linux:php8.2-snmp, p-cpe:/a:debian:debian_linux:php8.2-soap, p-cpe:/a:debian:debian_linux:php8.2-sqlite3, p-cpe:/a:debian:debian_linux:php8.2-sybase, p-cpe:/a:debian:debian_linux:php8.2-tidy, p-cpe:/a:debian:debian_linux:php8.2-xml, p-cpe:/a:debian:debian_linux:php8.2-xsl, p-cpe:/a:debian:debian_linux:php8.2-zip, p-cpe:/a:debian:debian_linux:php8.2

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/5/2026

Vulnerability Publication Date: 9/22/2026

Reference Information

CVE: CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682

IAVA: 2026-A-1074

Detections

Analytics