AZL-73195
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-73195.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-73195
- Upstream
- Published
- 2025-12-27T20:15:40Z
- Modified
- 2026-09-17T05:36:01Z
- Summary
- CVE-2025-14177 affecting package php for versions less than 8.3.29-1
- Details
-
In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
- References