Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:4059-1

Опубликовано: 08 сент. 2026
Источник: suse-cvrf

Описание

Security update for php-composer2

This update for php-composer2 fixes the following issue:

  • CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL (bsc#1278257).

Список пакетов

Container bci/php-apache:latest
php-composer2-2.6.4-150600.3.18.1
Container bci/php-fpm:latest
php-composer2-2.6.4-150600.3.18.1
Container bci/php:latest
php-composer2-2.6.4-150600.3.18.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7
php-composer2-2.6.4-150600.3.18.1
SUSE Linux Enterprise Server 15 SP6-LTSS
php-composer2-2.6.4-150600.3.18.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6
php-composer2-2.6.4-150600.3.18.1

Ссылки

Описание

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

Затронутые продукты
Container bci/php-apache:latest:php-composer2-2.6.4-150600.3.18.1
Container bci/php-fpm:latest:php-composer2-2.6.4-150600.3.18.1
Container bci/php:latest:php-composer2-2.6.4-150600.3.18.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7:php-composer2-2.6.4-150600.3.18.1
Ссылки