ELSA-2026-87080

Описание

libzip [1.6.1-1]

• update to 1.6.1
• enable lzma support

[1.5.2-1]

• update to 1.5.2
• add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available

[1.5.1-1]

• update to 1.5.1
• drop dependency on zlib-devel and bzip2-devel no more referenced in libzip.pc
• drop rpath patch merged upstream

[1.5.0-2]

• add dependency on zlib-devel and bzip2-devel #1556068

[1.5.0-1]

• update to 1.5.0
• use openssl for cryptography instead of bundled custom AES implementation

[1.4.0-5]

• missing BR on C compiler
• use ldconfig_scriptlets

[1.4.0-4]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1.4.0-3]

• add upstream patch and drop multilib hack

[1.4.0-2]

• re-add multilib hack #1529886

[1.4.0-1]

• update to 1.4.0
• switch to cmake
• add upstream patch for lib64

php [7.4.33-8]

• Avoid state corruption via bailout CVE-2026-109618, CVE-2026-109619

[7.4.33-7]

• Fix FILTER_SANITIZE_ENCODED does not encode 0xFF
• Fix IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison CVE-2026-91768
• Fixed Various packet overreads in mysqlnd wire protocol CVE-2025-1218
• Fix TLS hostname verification falls back to CN after SAN mismatch CVE-2026-91769
• Fix Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN CVE-2026-91767
• Fix Integer overflow in phar_tar_number() allowing TAR archive entry injection CVE-2026-6103
• Fix Unbounded recursion in server-side cleanup_xml_node() CVE-2026-91765
• Fix Integer overflow to buffer overflow in SOAP HTTP parsing CVE-2025-14181
• Fix Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL CVE-2026-92842
• Fix Cross-origin credential leak in HTTP stream wrapper redirects CVE-2026-91766
• Fix Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header CVE-2026-93682

[7.4.33-6]

• Fix leak on double DatePeriod::__construct() call
• Fixed SQL injection via E'...' backslash breakout CVE-2026-17543
• Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks CVE-2026-7260

[7.4.33-5]

• Fix Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD CVE-2026-14355

[7.4.33-4]

• Fix XSS within status endpoint CVE-2026-6735
• Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map CVE-2026-6722
• Fix Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION CVE-2026-7261
• Fix Broken Apache map value NULL check CVE-2026-7262
• Fix Signed integer overflow of char array offset CVE-2026-7568
• Fix Consistently pass unsigned char to ctype.h functions CVE-2026-7258

[7.4.33-3]

• Fix Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface GHSA-4w77-75f9-2c8w
• Fix Configuring a proxy in a stream context might allow for CRLF injection in URIs CVE-2024-11234
• Fix Single byte overread with convert.quoted-printable-decode filter CVE-2024-11233
• Fix Leak partial content of the heap through heap buffer over-read CVE-2024-8929
• Fix libxml streams use wrong content-type header when requesting a redirected resource CVE-2025-1219
• Fix Stream HTTP wrapper header check might omit basic auth header CVE-2025-1736
• Fix Stream HTTP wrapper truncate redirect location to 1024 bytes CVE-2025-1861
• Fix Streams HTTP wrapper does not fail for headers without colon CVE-2025-1734
• Fix Header parser of http stream wrapper does not handle folded headers CVE-2025-1217
• Fix pgsql extension does not check for errors during escaping CVE-2025-1735
• Fix NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix CVE-2025-6491
• Fix Null byte termination in hostnames CVE-2025-1220
• Fix Null byte termination in dns_get_record() GHSA-www2-q4fc-65wf
• Fix Heap buffer overflow in array_merge() CVE-2025-14178
• Fix Information Leak of Memory in getimagesize CVE-2025-14177

[7.4.33-2]

• fix low/moderate CVEs RHEL-66589
• Fix cgi.force_redirect configuration is bypassable due to the environment variable collision CVE-2024-8927
• Fix Logs from childrens may be altered CVE-2024-9026
• Fix Erroneous parsing of multipart form data CVE-2024-8925
• Fix filter bypass in filter_var FILTER_VALIDATE_URL CVE-2024-5458
• Fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix CVE-2024-2756
• Fix password_verify can erroneously return true opening ATO risk CVE-2024-3096
• Fix Security issue with external entity loading in XML without enabling it CVE-2023-3823
• Fix Buffer mismanagement in phar_dir_read() CVE-2023-3824
• Fix Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP CVE-2023-3247
• fix #81744: Password_verify() always return true with some hash CVE-2023-0567
• fix #81746: 1-byte array overrun in common path resolve code CVE-2023-0568
• fix DOS vulnerability when parsing multipart request body CVE-2023-0662

[7.4.33-1]

• rebase to 7.4.33
• fix: due to an integer overflow PDO::quote() may return unquoted string CVE-2022-31631

[7.4.30-1]

• rebase to 7.4.30 #2099615

[7.4.19-3]

• fix password of excessive length triggers buffer overflow leading to RCE CVE-2022-31626

php-pear [1:1.10.13-1]

• update PEAR to 1.10.13
• update Archive_Tar to 1.4.14

[1:1.10.12-1]

• update PEAR to 1.10.12
• update Archive_Tar to 1.4.9
• update Console_Getopt to 1.4.3
• update XML_Util to 1.4.5

[1:1.10.9-1]

• update PEAR to 1.10.9
• update Archive_Tar to 1.4.7
• update Console_Getopt to 1.4.2

[1:1.10.5-8]

• require /usr/bin/gpg instead of gnupg

[1:1.10.5-7]

• enable autoloader only in Fedora

[1:1.10.5-6]

• add patch for PHP 7.2 from https://github.com/pear/pear-core/pull/71

[1:1.10.5-5]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1:1.10.5-4]

• add autoloader for each package

[1:1.10.5-3]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[1:1.10.5-2]

• update XML_Util to 1.4.3 (no change)

php-pecl-apcu [5.1.18-1]

• update to 5.1.18

[5.1.17-1]

• update to 5.1.17

[5.1.12-1]

• update to 5.1.12 (stable)

[5.1.11-1]

• update to 5.1.11 (stable)

[5.1.10-1]

• update to 5.1.10 (stable)

[5.1.9-3]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[5.1.9-2]

• undefine _strict_symbol_defs_build

[5.1.9-1]

• Update to 5.1.9 (php 7, stable)

[5.1.8-5]

• rebuild for https://fedoraproject.org/wiki/Changes/php72

[5.1.8-4]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

php-pecl-rrd [2.0.1-1]

• build for RHEL 8

[2.0.1-13]

• rebuild for https://fedoraproject.org/wiki/Changes/php74

[2.0.1-12]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

[2.0.1-11]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

[2.0.1-10]

• Rebuild for https://fedoraproject.org/wiki/Changes/php73

[2.0.1-9]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

[2.0.1-8]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[2.0.1-7]

• undefine _strict_symbol_defs_build

[2.0.1-6]

• rebuild for https://fedoraproject.org/wiki/Changes/php72

[2.0.1-5]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

php-pecl-xdebug [2.9.5-1]

• update to 2.9.5

[2.8.0-1]

• build for RHEL 8 #1769857

[2.8.0-1]

• update to 2.8.0

[2.7.2-2]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

[2.7.2-1]

• update to 2.7.2

[2.7.1-1]

• update to 2.7.1

[2.7.0-1]

• update to 2.7.0 (stable)

[2.7.0-0.3.RC2]

• update to 2.7.0RC2

[2.7.0-0.2.rc1]

• update to 2.7.0RC1

[2.7.0-0.1.beta1.1]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

php-pecl-zip [1.18.2-1]

• update to 1.18.2

[1.15.4-1]

• Update to 1.15.4

[1.15.3-1]

• Update to 1.15.3

[1.15.2-3]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1.15.2-2]

• undefine _strict_symbol_defs_build

[1.15.2-1]

• Update to 1.15.2

[1.15.1-4]

• rebuild for https://fedoraproject.org/wiki/Changes/php72

[1.15.1-3]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

[1.15.1-2]

• Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[1.15.1-1]

• Update to 1.15.1