SUSE-SU-2026:1957-1
Security update for php8
Sévérité par source
Aucune source ne donne de score CVSS.
Le label propre à Trivy est CRITICAL. Critique selon SUSE.
Description
This update for php8 fixes the following issues - CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL injection (bsc#1264778). - CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776). - CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS (bsc#1264775). - CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access and denial of service (bsc#1264774). - CVE-2026-7259: NULL pointer dereference in `php_mb_check_encoding()` via `mb_ereg_search_init()` can lead to a denial of service (bsc#1264773). - CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772). - CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured can lead to a denial of service (bsc#1264771). - CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect the availability of the PHPprocess (bsc#1264769). Other updates: - Updated to 8.2.31.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| SUSE Linux Enterprise 15.6 | apache2-mod_php8, php8, php8-bcmath et 49 autres | 8.2.31-150600.3.28.1 |
Afficher les 52 entrées d'une source
| Source | Paquet | Corrigé en |
|---|---|---|
| SUSE Linux Enterprise 15.6 | apache2-mod_php8 | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8 | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-bcmath | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-bz2 | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-calendar | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-cli | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-ctype | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-curl | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-dba | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-devel | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-dom | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-embed | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-enchant | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-exif | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-fastcgi | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-fileinfo | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-fpm | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-ftp | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-gd | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-gettext | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-gmp | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-iconv | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-intl | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-ldap | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-mbstring | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-mysql | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-odbc | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-opcache | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-openssl | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-pcntl | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-pdo | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-pgsql | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-phar | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-posix | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-readline | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-shmop | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-snmp | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-soap | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-sockets | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-sodium | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-sqlite | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-sysvmsg | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-sysvsem | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-sysvshm | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-test | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-tidy | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-tokenizer | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-xmlreader | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-xmlwriter | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-xsl | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-zip | 8.2.31-150600.3.28.1 |
| SUSE Linux Enterprise 15.6 | php8-zlib | 8.2.31-150600.3.28.1 |
Références
- https://bugzilla.suse.com/1264769
- https://bugzilla.suse.com/1264771
- https://bugzilla.suse.com/1264772
- https://bugzilla.suse.com/1264773
- https://bugzilla.suse.com/1264774
- https://bugzilla.suse.com/1264775
- https://bugzilla.suse.com/1264776
- https://bugzilla.suse.com/1264778
Les 19 références
- https://lists.suse.com/pipermail/sle-updates/2026-May/046564.html
- https://www.suse.com/security/cve/CVE-2025-14179/
- https://www.suse.com/security/cve/CVE-2026-6722/
- https://www.suse.com/security/cve/CVE-2026-6735/
- https://www.suse.com/security/cve/CVE-2026-7258/
- https://www.suse.com/security/cve/CVE-2026-7259/
- https://www.suse.com/security/cve/CVE-2026-7261/
- https://www.suse.com/security/cve/CVE-2026-7262/
- https://www.suse.com/security/cve/CVE-2026-7568/
- https://www.suse.com/support/security/rating/
- https://www.suse.com/support/update/announcement/2026/suse-su-20261957-1/