CVE-2025-1220

Name	CVE-2025-1220
Description	In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php7.4 (PTS)	bullseye	7.4.33-1+deb11u5	vulnerable
	bullseye (security)	7.4.33-1+deb11u8	vulnerable
php8.2 (PTS)	bookworm, bookworm (security)	8.2.28-1~deb12u1	vulnerable
php8.4 (PTS)	sid, trixie	8.4.10-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
php7.4	source	(unstable)	(unfixed)
php8.2	source	(unstable)	(unfixed)
php8.4	source	(unstable)	8.4.10-1

Notes

https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r
Fixed by: https://github.com/php/php-src/commit/cac8f7f1cf4939f55f06b68120040f057682d89c (php-8.1.33)