Описание
Security update for php8
This update for php8 fixes the following issues
- Update to version 8.4.24
- CVE-2026-7260: Stack overflow in phar with circular symlinks (bsc#1273077).
- CVE-2026-9672: Upgrade libgd (bsc#1273078).
- CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout (bsc#1273075).
- CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale (bsc#1273076).
Список пакетов
openSUSE Leap 16.0
apache2-mod_php8-8.4.24-160000.1.1
php8-8.4.24-160000.1.1
php8-bcmath-8.4.24-160000.1.1
php8-bz2-8.4.24-160000.1.1
php8-calendar-8.4.24-160000.1.1
php8-cli-8.4.24-160000.1.1
php8-ctype-8.4.24-160000.1.1
php8-curl-8.4.24-160000.1.1
php8-dba-8.4.24-160000.1.1
php8-devel-8.4.24-160000.1.1
php8-dom-8.4.24-160000.1.1
php8-embed-8.4.24-160000.1.1
php8-enchant-8.4.24-160000.1.1
php8-exif-8.4.24-160000.1.1
php8-fastcgi-8.4.24-160000.1.1
php8-ffi-8.4.24-160000.1.1
php8-fileinfo-8.4.24-160000.1.1
php8-fpm-8.4.24-160000.1.1
php8-fpm-apache-8.4.24-160000.1.1
php8-ftp-8.4.24-160000.1.1
php8-gd-8.4.24-160000.1.1
php8-gettext-8.4.24-160000.1.1
php8-gmp-8.4.24-160000.1.1
php8-iconv-8.4.24-160000.1.1
php8-intl-8.4.24-160000.1.1
php8-ldap-8.4.24-160000.1.1
php8-mbstring-8.4.24-160000.1.1
php8-mysql-8.4.24-160000.1.1
php8-odbc-8.4.24-160000.1.1
php8-opcache-8.4.24-160000.1.1
php8-openssl-8.4.24-160000.1.1
php8-pcntl-8.4.24-160000.1.1
php8-pdo-8.4.24-160000.1.1
php8-pgsql-8.4.24-160000.1.1
php8-phar-8.4.24-160000.1.1
php8-posix-8.4.24-160000.1.1
php8-readline-8.4.24-160000.1.1
php8-shmop-8.4.24-160000.1.1
php8-snmp-8.4.24-160000.1.1
php8-soap-8.4.24-160000.1.1
php8-sockets-8.4.24-160000.1.1
php8-sodium-8.4.24-160000.1.1
php8-sqlite-8.4.24-160000.1.1
php8-sysvmsg-8.4.24-160000.1.1
php8-sysvsem-8.4.24-160000.1.1
php8-sysvshm-8.4.24-160000.1.1
php8-test-8.4.24-160000.1.1
php8-tidy-8.4.24-160000.1.1
php8-tokenizer-8.4.24-160000.1.1
php8-xmlreader-8.4.24-160000.1.1
php8-xmlwriter-8.4.24-160000.1.1
php8-xsl-8.4.24-160000.1.1
php8-zip-8.4.24-160000.1.1
php8-zlib-8.4.24-160000.1.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1273075
- SUSE Bug 1273076
- SUSE Bug 1273077
- SUSE Bug 1273078
- SUSE CVE CVE-2026-17543 page
- SUSE CVE CVE-2026-17544 page
- SUSE CVE CVE-2026-7260 page
- SUSE CVE CVE-2026-9672 page
Описание
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
Затронутые продукты
openSUSE Leap 16.0:apache2-mod_php8-8.4.24-160000.1.1
openSUSE Leap 16.0:php8-8.4.24-160000.1.1
openSUSE Leap 16.0:php8-bcmath-8.4.24-160000.1.1
openSUSE Leap 16.0:php8-bz2-8.4.24-160000.1.1
Ссылки
- CVE-2026-17543
- SUSE Bug 1273075
Описание
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
Затронутые продукты
openSUSE Leap 16.0:apache2-mod_php8-8.4.24-160000.1.1
openSUSE Leap 16.0:php8-8.4.24-160000.1.1
openSUSE Leap 16.0:php8-bcmath-8.4.24-160000.1.1
openSUSE Leap 16.0:php8-bz2-8.4.24-160000.1.1
Ссылки
- CVE-2026-17544
- SUSE Bug 1273076
Описание
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
Затронутые продукты
openSUSE Leap 16.0:apache2-mod_php8-8.4.24-160000.1.1
openSUSE Leap 16.0:php8-8.4.24-160000.1.1
openSUSE Leap 16.0:php8-bcmath-8.4.24-160000.1.1
openSUSE Leap 16.0:php8-bz2-8.4.24-160000.1.1
Ссылки
- CVE-2026-7260
- SUSE Bug 1273077
Описание
unknown
Затронутые продукты
openSUSE Leap 16.0:apache2-mod_php8-8.4.24-160000.1.1
openSUSE Leap 16.0:php8-8.4.24-160000.1.1
openSUSE Leap 16.0:php8-bcmath-8.4.24-160000.1.1
openSUSE Leap 16.0:php8-bz2-8.4.24-160000.1.1
Ссылки
- CVE-2026-9672
- SUSE Bug 1273078