Summary
php-pecl-apcu
[5.1.21-1]
- update to 5.1.21 for PHP 8.1 #2070040
php-pecl-rrd
[2.0.3-4]
- build for PHP 8.1 #2070040
php-pecl-xdebug3
[3.1.4-1]
- update to 3.1.4 for PHP 8.1 #2070040
php-pecl-zip
[1.20.1-1]
- update to 1.20.1 for PHP 8.1 #2070040
php
[8.1.14-1]
- rebase to 8.1.14
[8.1.8-1]
- update to 8.1.8 #2070040
[8.1.7-2]
- clean unneeded dependency on useradd command
[8.1.7-1]
- update to 8.1.7 #2070040
[8.1.6-2]
- add upstream patch to initialize pcre before mbstring
- add upstream patch to use more sha256 in openssl tests
[8.1.6-1]
- update to 8.1.6 #2070040
[8.0.13-1]
- rebase to 8.0.13 #2032429
- refresh configuration files from upstream
[8.0.12-1]
- rebase to 8.0.12 #2017111 #1981423
- build using system libxcrypt #2015903
[8.0.10-1]
- rebase to 8.0.10 #1992513
- compatibility with OpenSSL 3.0 #1992492
- snmp: add sha256 / sha512 security protocol #1936635
- phar: implement openssl_256 and openssl_512 for phar signatures
- phar: use sha256 signature by default
[8.0.6-9]
- Rebuilt for libffi 3.4.2 SONAME transition.
Related: rhbz#1891914
[8.0.6-8]
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
[8.0.6-7]
- Rebuild to pick up new build flags from redhat-rpm-config (#1984652)
[8.0.6-6]
- Rebuilt for RHEL 9 BETA for openssl 3.0
Related: rhbz#1971065
[8.0.6-5]
- fix build with net-snmp without DES #1953492
[8.0.6-4]
- fix build with openssl 3.0 #1953492
[8.0.6-3]
- get rid of inet_addr and gethostbyaddr calls
[8.0.6-2]
- get rid of inet_ntoa and inet_aton calls
[8.0.6-1]
- Update to 8.0.6 - http://www.php.net/releases/8_0_6.php
[8.0.5-1]
- Update to 8.0.5 - http://www.php.net/releases/8_0_5.php
[8.0.5~RC1-1]
- update to 8.0.5RC1
[8.0.4~RC1-2]
- make libdb usage conditional
default: on for Fedora, off for RHEL
[8.0.4~RC1-1]
- update to 8.0.4RC1
[8.0.3-2]
- clean conditions
[8.0.3-1]
- Update to 8.0.3 - http://www.php.net/releases/8_0_3.php
- see https://fedoraproject.org/wiki/Changes/php80
- drop xmlrpc extension
- drop json subpackage, extension always there
- enchant: use libenchant-2 instead of libenchant
[7.4.16-1]
- Update to 7.4.16 - http://www.php.net/releases/7_4_16.php
[7.4.15-3]
- drop php-imap, fix #1929640
[7.4.15-2]
- rebuild for libpq ABI fix rhbz#1908268
[7.4.15-1]
- Update to 7.4.15 - http://www.php.net/releases/7_4_15.php
- add upstream patch for https://bugs.php.net/80682
fix opcache doesn't honour pcre.jit option
[7.4.15~RC2-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
[7.4.15~RC2-1]
- update to 7.4.15RC2
Fixed packages 31
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | apcu-panel | 0:5.1.21-1.module+el9.1.0+20776+c1b960c0 |
| Oracle Linux · 9 | php | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-bcmath | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-cli | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-common | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-dba | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-dbg | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-devel | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-embedded | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-enchant | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-ffi | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-fpm | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-gd | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-gmp | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-intl | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-ldap | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-mbstring | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-mysqlnd | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-odbc | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-opcache | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-pdo | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-pecl-apcu | 0:5.1.21-1.module+el9.1.0+20776+c1b960c0 |
| Oracle Linux · 9 | php-pecl-apcu-devel | 0:5.1.21-1.module+el9.1.0+20776+c1b960c0 |
| Oracle Linux · 9 | php-pecl-rrd | 0:2.0.3-4.module+el9.1.0+20776+c1b960c0 |
| Oracle Linux · 9 | php-pecl-xdebug3 | 0:3.1.4-1.module+el9.1.0+20776+c1b960c0 |
| Oracle Linux · 9 | php-pecl-zip | 0:1.20.1-1.module+el9.1.0+20776+c1b960c0 |
| Oracle Linux · 9 | php-pgsql | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-process | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-snmp | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-soap | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
| Oracle Linux · 9 | php-xml | 0:8.1.14-1.module+el9.2.0+20960+2088691d |
Vulnerabilities 5
-
Critical 9.8
Buffer overflow in sponge queue functions
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
-
Critical 9.1
PDO::quote() may return unquoted string
In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to…
-
Medium 6.5
$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
-
Medium 6.5CVE-2022-31630 Public exploit
OOB read due to insufficient input validation in imageloadfont()
In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer wi…
-
Low 2.3
phar wrapper can occur dos when using quine gzip file
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.