SUSE-SU-2026:3514-1

Опубликовано: 05 авг. 2026

Источник: suse-cvrf

Описание

Security update for php8

This update for php8 fixes the following issues:

Update to version 8.2.33.

Security issues fixed:

CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion (bsc#1273077).
CVE-2026-9672: security issues in libgd (bsc#1273078).
CVE-2026-17543: improper escaping of backslashes in user-provided parameters allows for trivial SQL injection in ext-pgsql (bsc#1273075).
CVE-2026-14355: buffer allocation flaw in the AES-WRAP-PAD algorithm implementation can lead to heap metadata corruption and an application abort (bsc#1270351).

Список пакетов

SUSE Linux Enterprise Server 15 SP6-LTSS

apache2-mod_php8-8.2.33-150600.3.33.1

php8-8.2.33-150600.3.33.1

php8-bcmath-8.2.33-150600.3.33.1

php8-bz2-8.2.33-150600.3.33.1

php8-calendar-8.2.33-150600.3.33.1

php8-cli-8.2.33-150600.3.33.1

php8-ctype-8.2.33-150600.3.33.1

php8-curl-8.2.33-150600.3.33.1

php8-dba-8.2.33-150600.3.33.1

php8-devel-8.2.33-150600.3.33.1

php8-dom-8.2.33-150600.3.33.1

php8-embed-8.2.33-150600.3.33.1

php8-enchant-8.2.33-150600.3.33.1

php8-exif-8.2.33-150600.3.33.1

php8-fastcgi-8.2.33-150600.3.33.1

php8-fileinfo-8.2.33-150600.3.33.1

php8-fpm-8.2.33-150600.3.33.1

php8-ftp-8.2.33-150600.3.33.1

php8-gd-8.2.33-150600.3.33.1

php8-gettext-8.2.33-150600.3.33.1

php8-gmp-8.2.33-150600.3.33.1

php8-iconv-8.2.33-150600.3.33.1

php8-intl-8.2.33-150600.3.33.1

php8-ldap-8.2.33-150600.3.33.1

php8-mbstring-8.2.33-150600.3.33.1

php8-mysql-8.2.33-150600.3.33.1

php8-odbc-8.2.33-150600.3.33.1

php8-opcache-8.2.33-150600.3.33.1

php8-openssl-8.2.33-150600.3.33.1

php8-pcntl-8.2.33-150600.3.33.1

php8-pdo-8.2.33-150600.3.33.1

php8-pgsql-8.2.33-150600.3.33.1

php8-phar-8.2.33-150600.3.33.1

php8-posix-8.2.33-150600.3.33.1

php8-readline-8.2.33-150600.3.33.1

php8-shmop-8.2.33-150600.3.33.1

php8-snmp-8.2.33-150600.3.33.1

php8-soap-8.2.33-150600.3.33.1

php8-sockets-8.2.33-150600.3.33.1

php8-sodium-8.2.33-150600.3.33.1

php8-sqlite-8.2.33-150600.3.33.1

php8-sysvmsg-8.2.33-150600.3.33.1

php8-sysvsem-8.2.33-150600.3.33.1

php8-sysvshm-8.2.33-150600.3.33.1

php8-test-8.2.33-150600.3.33.1

php8-tidy-8.2.33-150600.3.33.1

php8-tokenizer-8.2.33-150600.3.33.1

php8-xmlreader-8.2.33-150600.3.33.1

php8-xmlwriter-8.2.33-150600.3.33.1

php8-xsl-8.2.33-150600.3.33.1

php8-zip-8.2.33-150600.3.33.1

php8-zlib-8.2.33-150600.3.33.1

SUSE Linux Enterprise Server for SAP Applications 15 SP6

apache2-mod_php8-8.2.33-150600.3.33.1

php8-8.2.33-150600.3.33.1

php8-bcmath-8.2.33-150600.3.33.1

php8-bz2-8.2.33-150600.3.33.1

php8-calendar-8.2.33-150600.3.33.1

php8-cli-8.2.33-150600.3.33.1

php8-ctype-8.2.33-150600.3.33.1

php8-curl-8.2.33-150600.3.33.1

php8-dba-8.2.33-150600.3.33.1

php8-devel-8.2.33-150600.3.33.1

php8-dom-8.2.33-150600.3.33.1

php8-embed-8.2.33-150600.3.33.1

php8-enchant-8.2.33-150600.3.33.1

php8-exif-8.2.33-150600.3.33.1

php8-fastcgi-8.2.33-150600.3.33.1

php8-fileinfo-8.2.33-150600.3.33.1

php8-fpm-8.2.33-150600.3.33.1

php8-ftp-8.2.33-150600.3.33.1

php8-gd-8.2.33-150600.3.33.1

php8-gettext-8.2.33-150600.3.33.1

php8-gmp-8.2.33-150600.3.33.1

php8-iconv-8.2.33-150600.3.33.1

php8-intl-8.2.33-150600.3.33.1

php8-ldap-8.2.33-150600.3.33.1

php8-mbstring-8.2.33-150600.3.33.1

php8-mysql-8.2.33-150600.3.33.1

php8-odbc-8.2.33-150600.3.33.1

php8-opcache-8.2.33-150600.3.33.1

php8-openssl-8.2.33-150600.3.33.1

php8-pcntl-8.2.33-150600.3.33.1

php8-pdo-8.2.33-150600.3.33.1

php8-pgsql-8.2.33-150600.3.33.1

php8-phar-8.2.33-150600.3.33.1

php8-posix-8.2.33-150600.3.33.1

php8-readline-8.2.33-150600.3.33.1

php8-shmop-8.2.33-150600.3.33.1

php8-snmp-8.2.33-150600.3.33.1

php8-soap-8.2.33-150600.3.33.1

php8-sockets-8.2.33-150600.3.33.1

php8-sodium-8.2.33-150600.3.33.1

php8-sqlite-8.2.33-150600.3.33.1

php8-sysvmsg-8.2.33-150600.3.33.1

php8-sysvsem-8.2.33-150600.3.33.1

php8-sysvshm-8.2.33-150600.3.33.1

php8-test-8.2.33-150600.3.33.1

php8-tidy-8.2.33-150600.3.33.1

php8-tokenizer-8.2.33-150600.3.33.1

php8-xmlreader-8.2.33-150600.3.33.1

php8-xmlwriter-8.2.33-150600.3.33.1

php8-xsl-8.2.33-150600.3.33.1

php8-zip-8.2.33-150600.3.33.1

php8-zlib-8.2.33-150600.3.33.1

Ссылки

https://www.suse.com/support/update/announcement/2026/suse-su-20263514-1/
Link for SUSE-SU-2026:3514-1
https://lists.suse.com/pipermail/sle-updates/2026-August/049091.html
E-Mail link for SUSE-SU-2026:3514-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1270351
SUSE Bug 1270351
https://bugzilla.suse.com/1273075
SUSE Bug 1273075
https://bugzilla.suse.com/1273077
SUSE Bug 1273077
https://bugzilla.suse.com/1273078
SUSE Bug 1273078
https://www.suse.com/security/cve/CVE-2026-14355/
SUSE CVE CVE-2026-14355 page
https://www.suse.com/security/cve/CVE-2026-17543/
SUSE CVE CVE-2026-17543 page
https://www.suse.com/security/cve/CVE-2026-7260/
SUSE CVE CVE-2026-7260 page
https://www.suse.com/security/cve/CVE-2026-9672/
SUSE CVE CVE-2026-9672 page

Описание

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

Затронутые продукты

SUSE Linux Enterprise Server 15 SP6-LTSS:apache2-mod_php8-8.2.33-150600.3.33.1

SUSE Linux Enterprise Server 15 SP6-LTSS:php8-8.2.33-150600.3.33.1

SUSE Linux Enterprise Server 15 SP6-LTSS:php8-bcmath-8.2.33-150600.3.33.1

SUSE Linux Enterprise Server 15 SP6-LTSS:php8-bz2-8.2.33-150600.3.33.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-14355.html
CVE-2026-14355
https://bugzilla.suse.com/1270351
SUSE Bug 1270351

Описание

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

Затронутые продукты

SUSE Linux Enterprise Server 15 SP6-LTSS:apache2-mod_php8-8.2.33-150600.3.33.1

SUSE Linux Enterprise Server 15 SP6-LTSS:php8-8.2.33-150600.3.33.1

SUSE Linux Enterprise Server 15 SP6-LTSS:php8-bcmath-8.2.33-150600.3.33.1

SUSE Linux Enterprise Server 15 SP6-LTSS:php8-bz2-8.2.33-150600.3.33.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-17543.html
CVE-2026-17543
https://bugzilla.suse.com/1273075
SUSE Bug 1273075

Описание

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

Затронутые продукты

SUSE Linux Enterprise Server 15 SP6-LTSS:apache2-mod_php8-8.2.33-150600.3.33.1

SUSE Linux Enterprise Server 15 SP6-LTSS:php8-8.2.33-150600.3.33.1

SUSE Linux Enterprise Server 15 SP6-LTSS:php8-bcmath-8.2.33-150600.3.33.1

SUSE Linux Enterprise Server 15 SP6-LTSS:php8-bz2-8.2.33-150600.3.33.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-7260.html
CVE-2026-7260
https://bugzilla.suse.com/1273077
SUSE Bug 1273077

Описание

unknown

Затронутые продукты

SUSE Linux Enterprise Server 15 SP6-LTSS:apache2-mod_php8-8.2.33-150600.3.33.1

SUSE Linux Enterprise Server 15 SP6-LTSS:php8-8.2.33-150600.3.33.1

SUSE Linux Enterprise Server 15 SP6-LTSS:php8-bcmath-8.2.33-150600.3.33.1

SUSE Linux Enterprise Server 15 SP6-LTSS:php8-bz2-8.2.33-150600.3.33.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-9672.html
CVE-2026-9672
https://bugzilla.suse.com/1273078
SUSE Bug 1273078

SUSE-SU-2026:3514-1

Описание

Список пакетов

SUSE Linux Enterprise Server 15 SP6-LTSS

SUSE Linux Enterprise Server for SAP Applications 15 SP6

Ссылки

Уязвимость: CVE-2026-14355

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-17543

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-7260

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-9672

Описание

Затронутые продукты

Ссылки