Summary
php
[8.3.19-1]
- rebase to 8.3.19
[8.3.15-1]
- rebase to 8.3.15
[8.3.12-1]
- rebase to 8.3.12 RHEL-62189
- enable command history in phpdbg
- backport Argon2 password hashing in OpenSSL ext
- build sockets extension statically
- switch to nikic/php-parser version 5
- openssl: always warn about missing curve_name
[8.2.13-1]
- rebase to 8.2.13 RHEL-14699
- add %__phpize and %__phpconfig macros
- move httpd/nginx wants directives to config files in /etc
- php-fpm.conf: move include directive after [global] section
following upstream example, allowing overriding
- use SPDX license IDs
php-pecl-apcu
php-pecl-redis6
[6.1.0-2]
- ignore 1 ONLINE test
[6.1.0-1]
- RHEL build
[6.1.0-1]
- update to 6.1.0
- drop patch merged upstream
[6.1.0~RC2-1]
- update to 6.1.0RC2
- fix test suite with redis 6.2 using patch from
https://github.com/phpredis/phpredis/pull/2555
[6.0.2-3]
- cleanup and modernize spec file
[6.0.2-2]
- use valkey on Fedora 41
- add upstream patch for PHP 8.4
[6.0.2-1]
- update to 6.0.2
[6.0.1-1]
- update to 6.0.1
[6.0.0-1]
- cleanup SCL stuff for Fedora review
[6.0.0-1]
php-pecl-rrd
php-pecl-xdebug3
[3.3.1-1]
- update to 3.3.1 for PHP 8.3
php-pecl-zip
Fixed packages 32
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | apcu-panel | 0:5.1.23-1.module+el9.6.0+90525+5083e899 |
| Oracle Linux · 9 | php | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-bcmath | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-cli | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-common | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-dba | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-dbg | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-devel | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-embedded | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-enchant | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-ffi | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-fpm | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-gd | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-gmp | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-intl | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-ldap | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-mbstring | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-mysqlnd | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-odbc | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-opcache | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-pdo | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-pecl-apcu | 0:5.1.23-1.module+el9.6.0+90525+5083e899 |
| Oracle Linux · 9 | php-pecl-apcu-devel | 0:5.1.23-1.module+el9.6.0+90525+5083e899 |
| Oracle Linux · 9 | php-pecl-redis6 | 0:6.1.0-2.module+el9.6.0+90525+5083e899 |
| Oracle Linux · 9 | php-pecl-rrd | 0:2.0.3-4.module+el9.6.0+90525+5083e899 |
| Oracle Linux · 9 | php-pecl-xdebug3 | 0:3.3.1-1.module+el9.6.0+90525+5083e899 |
| Oracle Linux · 9 | php-pecl-zip | 0:1.22.3-1.module+el9.6.0+90525+5083e899 |
| Oracle Linux · 9 | php-pgsql | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-process | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-snmp | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-soap | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
| Oracle Linux · 9 | php-xml | 0:8.3.19-1.module+el9.6.0+90584+da8065b7 |
Vulnerabilities 6
-
Critical 9.2
Reference counting in php_request_shutdown causes Use-After-Free
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by su…
-
Medium 6.3
Header parser of http stream wrapper does not handle folded headers
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the re…
-
Medium 6.3CVE-2025-1219 Public exploit
libxml streams use wrong content-type header when requesting a redirected resource
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the reques…
-
Medium 6.3
Streams HTTP wrapper does not fail for headers with invalid name and no colon
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse appl…
-
Medium 6.3
Stream HTTP wrapper header check might omit basic auth header
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to…
-
Medium 6.3
Stream HTTP wrapper truncates redirect location to 1024 bytes
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the loca…