openSUSE-SU-2026:20745-1
Security update for php8
Severidad por fuente
Ninguna fuente da una puntuación CVSS.
La etiqueta propia de Trivy es CRITICAL. Crítica según SUSE.
Descripción
This update for php8 fixes the following issues - CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL injection (bsc#1264778). - CVE-2026-6104: out-of-bounds read when processing an encoding name containing an embedded NULL byte in `mb_convert_encoding()` can lead to information disclosure and denial of service (bsc#1264777). - CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776). - CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS (bsc#1264775). - CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access and denial of service (bsc#1264774). - CVE-2026-7259: NULL pointer dereference in `php_mb_check_encoding()` via `mb_ereg_search_init()` can lead to a denial of service (bsc#1264773). - CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772). - CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured can lead to a denial of service (bsc#1264771). - CVE-2026-7263: incorrect processing of XML data in the `DOMNode: C14N()` method can lead to an infinite loop and a denial of service (bsc#1264770). - CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect the availability of the PHPprocess (bsc#1264769). Other updates: - Updated to 8.4.21.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| openSUSE Leap 16.0 | apache2-mod_php8, php8, php8-bcmath y 51 más | 8.4.21-160000.1.1 |
Mostrar las 54 entradas de 1 fuente
| Fuente | Paquete | Corregido en |
|---|---|---|
| openSUSE Leap 16.0 | apache2-mod_php8 | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8 | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-bcmath | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-bz2 | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-calendar | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-cli | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-ctype | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-curl | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-dba | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-devel | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-dom | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-embed | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-enchant | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-exif | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-fastcgi | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-ffi | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-fileinfo | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-fpm | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-fpm-apache | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-ftp | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-gd | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-gettext | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-gmp | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-iconv | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-intl | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-ldap | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-mbstring | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-mysql | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-odbc | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-opcache | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-openssl | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-pcntl | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-pdo | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-pgsql | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-phar | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-posix | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-readline | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-shmop | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-snmp | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-soap | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-sockets | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-sodium | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-sqlite | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-sysvmsg | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-sysvsem | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-sysvshm | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-test | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-tidy | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-tokenizer | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-xmlreader | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-xmlwriter | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-xsl | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-zip | 8.4.21-160000.1.1 |
| openSUSE Leap 16.0 | php8-zlib | 8.4.21-160000.1.1 |
Referencias
- https://bugzilla.suse.com/1264769
- https://bugzilla.suse.com/1264770
- https://bugzilla.suse.com/1264771
- https://bugzilla.suse.com/1264772
- https://bugzilla.suse.com/1264773
- https://bugzilla.suse.com/1264774
- https://bugzilla.suse.com/1264775
- https://bugzilla.suse.com/1264776
Las 21 referencias
- https://bugzilla.suse.com/1264777
- https://bugzilla.suse.com/1264778
- https://www.suse.com/security/cve/CVE-2025-14179/
- https://www.suse.com/security/cve/CVE-2026-6104/
- https://www.suse.com/security/cve/CVE-2026-6722/
- https://www.suse.com/security/cve/CVE-2026-6735/
- https://www.suse.com/security/cve/CVE-2026-7258/
- https://www.suse.com/security/cve/CVE-2026-7259/
- https://www.suse.com/security/cve/CVE-2026-7261/
- https://www.suse.com/security/cve/CVE-2026-7262/
- https://www.suse.com/security/cve/CVE-2026-7263/
- https://www.suse.com/security/cve/CVE-2026-7568/
- https://www.suse.com/support/security/rating/