Вернуться к предупреждениям о безопасности

ADOdb Vulnerability — Ubuntu Security Update (USN-7530-2)

USN-7530-2 backports the ADOdb fix (CVE-2025-46337, CVSS 10) to Ubuntu 16.04 through 24.04 LTS: the PHP database abstraction library carried a flaw (improper handling leading to SQL injection class impact per the upstream advisory) that reaches legacy PHP applications. Update: sudo apt update && sudo apt upgrade libphp-adodb and restart the PHP applications using it.

Critical 10 CVSS 2026-11-04

Ubuntu 20.04 Ubuntu 22.04

Что это значит по лицензии SharedLicense

A CVSS 10 flaw in a database-abstraction library sits under every query a legacy PHP application runs — exploitation means database compromise for any app still on the affected ADOdb version.

Ubuntu Security Notices
USN-7530-2

Publication date

4 November 2026

Overview

ADOdb could be made to crash or run programs if it received
specially crafted input.

Releases

Packages

libphp-adodb – PHP database abstraction layer library

Details

USN-7530-1 fixed a vulnerability in ADOdb. This update provides the
corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.

Original advisory details:

It was discovered that ADOdb incorrectly handled SQL input. A remote
attacker could use this issue to execute arbitrary SQL commands.

USN-7530-1 fixed a vulnerability in ADOdb. This update provides the
corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.

Original advisory details:

It was discovered that ADOdb incorrectly handled SQL input. A remote
attacker could use this issue to execute arbitrary SQL commands.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
24.04 LTS noble	libphp-adodb – 5.21.4-1ubuntu0.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.
22.04 LTS jammy	libphp-adodb – 5.20.19-1ubuntu0.1+esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.
20.04 LTS focal	libphp-adodb – 5.20.16-1ubuntu0.1~esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.
18.04 LTS bionic	libphp-adodb – 5.20.9-1ubuntu0.1~esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.
16.04 LTS xenial	libphp-adodb – 5.20.3-1ubuntu1+esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

References

CVE-2025-46337

CVE-2025-46337

Related notices

USN-7530-1

USN-7530-1

Часто задаваемые вопросы

What is CVE-2025-46337?

It is a Critical (CVSS 10) vulnerability in the ADOdb database abstraction library for PHP, fixed upstream and now backported by Ubuntu for releases 16.04 through 24.04 LTS in USN-7530-2.

Who is affected?

Systems with the libphp-adodb package installed running legacy PHP applications — older in-house tools and legacy CMS installs are the typical population.

How do I apply the fix?

Run sudo apt update && sudo apt upgrade libphp-adodb and restart the PHP applications using ADOdb so they load the patched library.

Why is a backport notice for old Ubuntu branches important?

Because legacy PHP applications on EOL branches rarely upgrade libraries themselves — the backport is the only realistic fix path for those installs, and this notice makes it available per branch.

Источники

Предупреждения о безопасности

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему