critical
CVE-2025-14179
php: SQL injection in pdo_firebird via NUL bytes in quoted strings
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami. Rated lower by Red Hat (high), Azure Linux (high), Ubuntu (medium).
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | libphp, php, php-min | 8.2.31, 8.3.31, 8.4.21, 8.5.6 |
| Azure Linux 3.0 | php | 0:8.3.31-1.azl3 |
| chainguard | php-8.2 | 8.2.31-r0 |
| debian 12 | php8.2 | 8.2.31-1~deb12u1 |
| debian 13 | php8.4 | 8.4.21-1~deb13u1 |
| debian 14 | php8.4 | 8.4.21-1 |
| echo | php-7.2, php-8.1, php8.2 and 1 more | 7.2.34+e1 and 3 more |
| minimos | php-8.2, php-8.3, php-8.4 and 1 more | 8.2.31-r0 and 3 more |
| rapidfort alma 10 | php, php-bcmath, php-cli and 22 more | no fix listed |
| rapidfort debian 12 | php8.2 | 0:8.2.31-1~deb12u1 |
| rapidfort debian 13 | php8.2 | 0:8.2.31-1~deb12u1 |
| rapidfort fedora 43 | php, php-bcmath, php-cli and 26 more | 8.4.21-1.fc43 |
Show all 161 entries from 23 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | libphp | 8.2.31, 8.3.31, 8.4.21, 8.5.6 |
| bitnami::Bitnami Vulnerability Database | php | 8.2.31, 8.3.31, 8.4.21, 8.5.6 |
| bitnami::Bitnami Vulnerability Database | php-min | 8.2.31, 8.3.31, 8.4.21, 8.5.6 |
| Azure Linux 3.0 | php | 0:8.3.31-1.azl3 |
| chainguard | php-8.2 | 8.2.31-r0 |
| debian 12 | php8.2 | 8.2.31-1~deb12u1 |
| debian 13 | php8.4 | 8.4.21-1~deb13u1 |
| debian 14 | php8.4 | 8.4.21-1 |
| echo | php-7.2 | 7.2.34+e1 |
| echo | php-8.1 | 8.1.34+e1 |
| echo | php8.2 | 8.2.31-1~deb12u1 |
| echo | php8.4 | 8.4.21-1~deb13u1 |
| minimos | php-8.2 | 8.2.31-r0 |
| minimos | php-8.3 | 8.3.31-r0 |
| minimos | php-8.4 | 8.4.21-r0 |
| minimos | php-8.5 | 8.5.6-r0 |
| rapidfort alma 10 | php | no fix listed |
| rapidfort alma 10 | php-bcmath | no fix listed |
| rapidfort alma 10 | php-cli | no fix listed |
| rapidfort alma 10 | php-common | no fix listed |
| rapidfort alma 10 | php-dba | no fix listed |
| rapidfort alma 10 | php-dbg | no fix listed |
| rapidfort alma 10 | php-devel | no fix listed |
| rapidfort alma 10 | php-embedded | no fix listed |
| rapidfort alma 10 | php-enchant | no fix listed |
| rapidfort alma 10 | php-ffi | no fix listed |
| rapidfort alma 10 | php-fpm | no fix listed |
| rapidfort alma 10 | php-gd | no fix listed |
| rapidfort alma 10 | php-gmp | no fix listed |
| rapidfort alma 10 | php-intl | no fix listed |
| rapidfort alma 10 | php-ldap | no fix listed |
| rapidfort alma 10 | php-mbstring | no fix listed |
| rapidfort alma 10 | php-mysqlnd | no fix listed |
| rapidfort alma 10 | php-odbc | no fix listed |
| rapidfort alma 10 | php-opcache | no fix listed |
| rapidfort alma 10 | php-pdo | no fix listed |
| rapidfort alma 10 | php-pgsql | no fix listed |
| rapidfort alma 10 | php-process | no fix listed |
| rapidfort alma 10 | php-snmp | no fix listed |
| rapidfort alma 10 | php-soap | no fix listed |
| rapidfort alma 10 | php-xml | no fix listed |
| rapidfort debian 12 | php8.2 | 0:8.2.31-1~deb12u1 |
| rapidfort debian 13 | php8.2 | 0:8.2.31-1~deb12u1 |
| rapidfort fedora 43 | php | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-bcmath | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-cli | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-common | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-dba | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-dbg | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-devel | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-embedded | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-enchant | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-ffi | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-fpm | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-gd | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-gmp | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-intl | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-ldap | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-mbstring | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-mysqlnd | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-odbc | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-opcache | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-pdo | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-pdo-dblib | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-pdo-firebird | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-pgsql | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-process | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-snmp | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-soap | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-sodium | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-tidy | 8.4.21-1.fc43 |
| rapidfort fedora 43 | php-xml | 8.4.21-1.fc43 |
| rapidfort Oracle Linux 10 | php | no fix listed |
| rapidfort Oracle Linux 10 | php-bcmath | no fix listed |
| rapidfort Oracle Linux 10 | php-cli | no fix listed |
| rapidfort Oracle Linux 10 | php-common | no fix listed |
| rapidfort Oracle Linux 10 | php-dba | no fix listed |
| rapidfort Oracle Linux 10 | php-dbg | no fix listed |
| rapidfort Oracle Linux 10 | php-devel | no fix listed |
| rapidfort Oracle Linux 10 | php-embedded | no fix listed |
| rapidfort Oracle Linux 10 | php-enchant | no fix listed |
| rapidfort Oracle Linux 10 | php-ffi | no fix listed |
| rapidfort Oracle Linux 10 | php-fpm | no fix listed |
| rapidfort Oracle Linux 10 | php-gd | no fix listed |
| rapidfort Oracle Linux 10 | php-gmp | no fix listed |
| rapidfort Oracle Linux 10 | php-intl | no fix listed |
| rapidfort Oracle Linux 10 | php-ldap | no fix listed |
| rapidfort Oracle Linux 10 | php-mbstring | no fix listed |
| rapidfort Oracle Linux 10 | php-mysqlnd | no fix listed |
| rapidfort Oracle Linux 10 | php-odbc | no fix listed |
| rapidfort Oracle Linux 10 | php-opcache | no fix listed |
| rapidfort Oracle Linux 10 | php-pdo | no fix listed |
| rapidfort Oracle Linux 10 | php-pgsql | no fix listed |
| rapidfort Oracle Linux 10 | php-process | no fix listed |
| rapidfort Oracle Linux 10 | php-snmp | no fix listed |
| rapidfort Oracle Linux 10 | php-soap | no fix listed |
| rapidfort Oracle Linux 10 | php-xml | no fix listed |
| rapidfort Red Hat 10 | php | no fix listed |
| rapidfort Red Hat 10 | php-bcmath | no fix listed |
| rapidfort Red Hat 10 | php-cli | no fix listed |
| rapidfort Red Hat 10 | php-common | no fix listed |
| rapidfort Red Hat 10 | php-dba | no fix listed |
| rapidfort Red Hat 10 | php-dbg | no fix listed |
| rapidfort Red Hat 10 | php-devel | no fix listed |
| rapidfort Red Hat 10 | php-embedded | no fix listed |
| rapidfort Red Hat 10 | php-enchant | no fix listed |
| rapidfort Red Hat 10 | php-ffi | no fix listed |
| rapidfort Red Hat 10 | php-fpm | no fix listed |
| rapidfort Red Hat 10 | php-gd | no fix listed |
| rapidfort Red Hat 10 | php-gmp | no fix listed |
| rapidfort Red Hat 10 | php-intl | no fix listed |
| rapidfort Red Hat 10 | php-ldap | no fix listed |
| rapidfort Red Hat 10 | php-mbstring | no fix listed |
| rapidfort Red Hat 10 | php-mysqlnd | no fix listed |
| rapidfort Red Hat 10 | php-odbc | no fix listed |
| rapidfort Red Hat 10 | php-opcache | no fix listed |
| rapidfort Red Hat 10 | php-pdo | no fix listed |
| rapidfort Red Hat 10 | php-pgsql | no fix listed |
| rapidfort Red Hat 10 | php-process | no fix listed |
| rapidfort Red Hat 10 | php-snmp | no fix listed |
| rapidfort Red Hat 10 | php-soap | no fix listed |
| rapidfort Red Hat 10 | php-xml | no fix listed |
| rapidfort rocky 10 | php | no fix listed |
| rapidfort rocky 10 | php-bcmath | no fix listed |
| rapidfort rocky 10 | php-cli | no fix listed |
| rapidfort rocky 10 | php-common | no fix listed |
| rapidfort rocky 10 | php-dba | no fix listed |
| rapidfort rocky 10 | php-dbg | no fix listed |
| rapidfort rocky 10 | php-devel | no fix listed |
| rapidfort rocky 10 | php-embedded | no fix listed |
| rapidfort rocky 10 | php-enchant | no fix listed |
| rapidfort rocky 10 | php-ffi | no fix listed |
| rapidfort rocky 10 | php-fpm | no fix listed |
| rapidfort rocky 10 | php-gd | no fix listed |
| rapidfort rocky 10 | php-gmp | no fix listed |
| rapidfort rocky 10 | php-intl | no fix listed |
| rapidfort rocky 10 | php-ldap | no fix listed |
| rapidfort rocky 10 | php-mbstring | no fix listed |
| rapidfort rocky 10 | php-mysqlnd | no fix listed |
| rapidfort rocky 10 | php-odbc | no fix listed |
| rapidfort rocky 10 | php-opcache | no fix listed |
| rapidfort rocky 10 | php-pdo | no fix listed |
| rapidfort rocky 10 | php-pgsql | no fix listed |
| rapidfort rocky 10 | php-process | no fix listed |
| rapidfort rocky 10 | php-snmp | no fix listed |
| rapidfort rocky 10 | php-soap | no fix listed |
| rapidfort rocky 10 | php-xml | no fix listed |
| rapidfort ubuntu 20.04 | php8.1 | 0:8.1.2-1ubuntu2.24 |
| rapidfort ubuntu 20.04 | php8.3 | 0:8.3.6-0ubuntu0.24.04.9 |
| rapidfort ubuntu 20.04 | php8.5 | 0:8.5.4-0ubuntu1.1 |
| rapidfort ubuntu 22.04 | php8.1 | 0:8.1.2-1ubuntu2.24 |
| rapidfort ubuntu 22.04 | php8.3 | 0:8.3.6-0ubuntu0.24.04.9 |
| rapidfort ubuntu 22.04 | php8.5 | 0:8.5.4-0ubuntu1.1 |
| rapidfort ubuntu 24.04 | php8.1 | 0:8.1.2-1ubuntu2.24 |
| rapidfort ubuntu 24.04 | php8.3 | 0:8.3.6-0ubuntu0.24.04.9 |
| rapidfort ubuntu 24.04 | php8.5 | 0:8.5.4-0ubuntu1.1 |
| ubuntu 22.04 | php8.1 | 8.1.2-1ubuntu2.24 |
| ubuntu 24.04 | php8.3 | 8.3.6-0ubuntu0.24.04.9 |
| ubuntu 25.10 | php8.4 | 8.4.11-1ubuntu1.2 |
| ubuntu 26.04 | php8.5 | 8.5.4-0ubuntu1.1 |
| wolfi | php-8.2 | 8.2.31-r0 |
References
- https://access.redhat.com/security/cve/CVE-2025-14179
- https://bugzilla.redhat.com/show_bug.cgi?id=2468567
- https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
- https://nvd.nist.gov/vuln/detail/CVE-2025-14179
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14179.json
- https://ubuntu.com/security/notices/USN-8336-1
- https://ubuntu.com/security/notices/USN-8513-1
- https://www.cve.org/CVERecord?id=CVE-2025-14179