openSUSE-SU-2026:20745-1
Security update for php8
Einstufung nach Quelle
Keine Quelle nennt einen CVSS-Wert.
Trivys eigenes Label ist CRITICAL. Kritisch laut SUSE.
Beschreibung
This update for php8 fixes the following issues - CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL injection (bsc#1264778). - CVE-2026-6104: out-of-bounds read when processing an encoding name containing an embedded NULL byte in `mb_convert_encoding()` can lead to information disclosure and denial of service (bsc#1264777). - CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776). - CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS (bsc#1264775). - CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access and denial of service (bsc#1264774). - CVE-2026-7259: NULL pointer dereference in `php_mb_check_encoding()` via `mb_ereg_search_init()` can lead to a denial of service (bsc#1264773). - CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772). - CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured can lead to a denial of service (bsc#1264771). - CVE-2026-7263: incorrect processing of XML data in the `DOMNode: C14N()` method can lead to an infinite loop and a denial of service (bsc#1264770). - CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect the availability of the PHPprocess (bsc#1264769). Other updates: - Updated to 8.4.21.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| openSUSE Leap 16.0 | apache2-mod_php8, php8, php8-bcmath und 51 weitere | 8.4.21-160000.1.1 |
Alle 54 Einträge aus 1 Quelle zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| openSUSE Leap 16.0 | apache2-mod_php8 | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8 | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-bcmath | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-bz2 | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-calendar | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-cli | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-ctype | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-curl | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-dba | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-devel | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-dom | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-embed | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-enchant | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-exif | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-fastcgi | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-ffi | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-fileinfo | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-fpm | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-fpm-apache | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-ftp | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-gd | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-gettext | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-gmp | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-iconv | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-intl | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-ldap | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-mbstring | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-mysql | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-odbc | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-opcache | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-openssl | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-pcntl | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-pdo | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-pgsql | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-phar | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-posix | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-readline | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-shmop | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-snmp | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-soap | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-sockets | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-sodium | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-sqlite | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-sysvmsg | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-sysvsem | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-sysvshm | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-test | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-tidy | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-tokenizer | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-xmlreader | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-xmlwriter | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-xsl | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-zip | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-zlib | 8.4.21-160000.1.1 |
Referenzen
- https://bugzilla.suse.com/1264769
- https://bugzilla.suse.com/1264770
- https://bugzilla.suse.com/1264771
- https://bugzilla.suse.com/1264772
- https://bugzilla.suse.com/1264773
- https://bugzilla.suse.com/1264774
- https://bugzilla.suse.com/1264775
- https://bugzilla.suse.com/1264776
Alle 21 Referenzen
- https://bugzilla.suse.com/1264777
- https://bugzilla.suse.com/1264778
- https://www.suse.com/security/cve/CVE-2025-14179/
- https://www.suse.com/security/cve/CVE-2026-6104/
- https://www.suse.com/security/cve/CVE-2026-6722/
- https://www.suse.com/security/cve/CVE-2026-6735/
- https://www.suse.com/security/cve/CVE-2026-7258/
- https://www.suse.com/security/cve/CVE-2026-7259/
- https://www.suse.com/security/cve/CVE-2026-7261/
- https://www.suse.com/security/cve/CVE-2026-7262/
- https://www.suse.com/security/cve/CVE-2026-7263/
- https://www.suse.com/security/cve/CVE-2026-7568/
- https://www.suse.com/support/security/rating/