Summary
php
[8.2.28-1]
- rebase to 8.2.28
[8.2.25-1]
- rebase to 8.2.25 RHEL-65837
[8.2.13-1]
- rebase to 8.2.13 RHEL-14699
- add %__phpize and %__phpconfig macros
- move httpd/nginx wants directives to config files in /etc
- php-fpm.conf: move include directive after [global] section
following upstream example, allowing overriding
- use SPDX license IDs
php-pecl-apcu
php-pecl-rrd
php-pecl-xdebug3
[3.2.2-2]
- drop inet_ntoa usage using upstream patch
[3.2.2-1]
- update to 3.2.2 for PHP 8.2 RHEL-14699
[3.1.4-1]
- update to 3.1.4 for PHP 8.1 #2070040
[3.1.2-1]
- update to 3.1.2 rhbz#2030322
php-pecl-zip
Fixed packages 31
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | apcu-panel | 0:5.1.23-1.module+el9.4.0+90261+af5cc950 |
| Oracle Linux · 9 | php | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-bcmath | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-cli | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-common | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-dba | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-dbg | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-devel | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-embedded | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-enchant | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-ffi | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-fpm | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-gd | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-gmp | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-intl | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-ldap | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-mbstring | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-mysqlnd | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-odbc | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-opcache | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-pdo | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-pecl-apcu | 0:5.1.23-1.module+el9.4.0+90261+af5cc950 |
| Oracle Linux · 9 | php-pecl-apcu-devel | 0:5.1.23-1.module+el9.4.0+90261+af5cc950 |
| Oracle Linux · 9 | php-pecl-rrd | 0:2.0.3-4.module+el9.4.0+90261+af5cc950 |
| Oracle Linux · 9 | php-pecl-xdebug3 | 0:3.2.2-2.module+el9.4.0+90261+af5cc950 |
| Oracle Linux · 9 | php-pecl-zip | 0:1.22.3-1.module+el9.4.0+90261+af5cc950 |
| Oracle Linux · 9 | php-pgsql | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-process | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-snmp | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-soap | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
| Oracle Linux · 9 | php-xml | 0:8.2.28-1.module+el9.6.0+90591+1cdbd55b |
Vulnerabilities 8
-
Medium 6.3
Header parser of http stream wrapper does not handle folded headers
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the re…
-
Medium 6.3CVE-2025-1219 Public exploit
libxml streams use wrong content-type header when requesting a redirected resource
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the reques…
-
Medium 6.3
Streams HTTP wrapper does not fail for headers with invalid name and no colon
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse appl…
-
Medium 6.3
Stream HTTP wrapper header check might omit basic auth header
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to…
-
Medium 6.3
Stream HTTP wrapper truncates redirect location to 1024 bytes
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the loca…
-
Medium 5.8
Leak partial content of the heap through heap buffer over-read in mysqlnd
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the …
-
Medium 4.8
Single byte overread with convert.quoted-printable-decode filter
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose conte…
-
Medium 4.8
Configuring a proxy in a stream context might allow for CRLF injection in URIs
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the …