USN-7530-2: Ubuntu extends ADOdb patch to LTS, Ubuntu Pro required

Canonical released USN-7530-2 on 4 November 2026, extending to Ubuntu LTS versions a fix released one and a half years earlier. Server administrators running panels or PHP applications that bundle ADOdb—the most common case being Moodle—and still use LTS instead of interim releases should review this advisory.

What it fixes

USN-7530-1 fixed a vulnerability in ADOdb. This update provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. The flaw, identified as CVE-2025-46337, affects ADOdb, a PHP library providing abstractions for query execution and database management: before version 5.22.9, improper escaping of a query parameter can allow an attacker to execute arbitrary SQL commands when code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data.

The key point for anyone debugging an incident: the attack surface is not the entire ADOdb installation, but only the PostgreSQL driver and that specific method. In the case of Moodle, Moodle core does not call this method, so only sites running third-party code that does are exposed. Anyone using plugins or custom modules that pass user input to pg_insert_id() remains vulnerable.

Fixed versions

Ubuntu Release	Package – version
24.04 LTS (noble)	libphp-adodb 5.21.4-1ubuntu0.1~esm1
22.04 LTS (jammy)	libphp-adodb 5.20.19-1ubuntu0.1+esm1
20.04 LTS (focal)	libphp-adodb 5.20.16-1ubuntu0.1~esm2
18.04 LTS (bionic)	libphp-adodb 5.20.9-1ubuntu0.1~esm2
16.04 LTS (xenial)	libphp-adodb 5.20.3-1ubuntu1+esm2

On all five releases the corrected package is available only with Ubuntu Pro via ESM Apps: without an active subscription, apt update && apt upgrade will not download the patch on these versions.

For non-LTS releases the fix arrived long ago: on 29 May 2025 Canonical had corrected the same flaw on Ubuntu 25.04 and 24.10, with libphp-adodb updated to 5.22.8-0.1ubuntu0.1 and 5.22.7-0.1ubuntu0.1 respectively.

What to do

For anyone running 16.04–24.04 LTS with the libphp-adodb package installed: first check the version with dpkg -l libphp-adodb, then verify whether Ubuntu Pro is active with pro status. Without Pro, the only options are to manually update to upstream version 5.22.9 or later, or isolate applications calling pg_insert_id() on PostgreSQL connections.