Summary
libzip
php
[8.2.28-1]
- rebase to 8.2.28
php-pear
php-pecl-apcu
php-pecl-rrd
php-pecl-xdebug3
php-pecl-zip
Fixed packages 35
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | apcu-panel | 0:5.1.23-1.module+el8.10.0+90469+8883f508 |
| Oracle Linux · 8 | libzip | 0:1.7.3-1.module+el8.10.0+90469+8883f508 |
| Oracle Linux · 8 | libzip-devel | 0:1.7.3-1.module+el8.10.0+90469+8883f508 |
| Oracle Linux · 8 | libzip-tools | 0:1.7.3-1.module+el8.10.0+90469+8883f508 |
| Oracle Linux · 8 | php | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-bcmath | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-cli | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-common | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-dba | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-dbg | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-devel | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-embedded | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-enchant | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-ffi | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-fpm | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-gd | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-gmp | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-intl | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-ldap | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-mbstring | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-mysqlnd | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-odbc | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-opcache | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-pdo | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-pear | 1:1.10.14-1.module+el8.10.0+90469+8883f508 |
| Oracle Linux · 8 | php-pecl-apcu | 0:5.1.23-1.module+el8.10.0+90469+8883f508 |
| Oracle Linux · 8 | php-pecl-apcu-devel | 0:5.1.23-1.module+el8.10.0+90469+8883f508 |
| Oracle Linux · 8 | php-pecl-rrd | 0:2.0.3-1.module+el8.10.0+90469+8883f508 |
| Oracle Linux · 8 | php-pecl-xdebug3 | 0:3.2.2-2.module+el8.10.0+90469+8883f508 |
| Oracle Linux · 8 | php-pecl-zip | 0:1.22.3-1.module+el8.10.0+90469+8883f508 |
| Oracle Linux · 8 | php-pgsql | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-process | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-snmp | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-soap | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
| Oracle Linux · 8 | php-xml | 0:8.2.28-1.module+el8.10.0+90667+8f0d9096 |
Vulnerabilities 8
-
Medium 6.3
Header parser of http stream wrapper does not handle folded headers
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the re…
-
Medium 6.3CVE-2025-1219 Public exploit
libxml streams use wrong content-type header when requesting a redirected resource
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the reques…
-
Medium 6.3
Streams HTTP wrapper does not fail for headers with invalid name and no colon
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse appl…
-
Medium 6.3
Stream HTTP wrapper header check might omit basic auth header
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to…
-
Medium 6.3
Stream HTTP wrapper truncates redirect location to 1024 bytes
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the loca…
-
Medium 5.8
Leak partial content of the heap through heap buffer over-read in mysqlnd
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the …
-
Medium 4.8
Single byte overread with convert.quoted-printable-decode filter
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose conte…
-
Medium 4.8
Configuring a proxy in a stream context might allow for CRLF injection in URIs
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the …