Skip to content
OpenAdvisories
High ELSA-2026-1412 6 CVEs

Important: php:8.2 security update (Oracle Linux 8)

Published Jan 28, 2026 · Updated Jan 28, 2026

Ecosystem: Oracle Linux

Summary

libzip
[1.7.3-1]
- update to 1.7.3

[1.6.1-1]
- update to 1.6.1
- enable lzma support

[1.5.2-1]
- update to 1.5.2
- add all explicit cmake options to ensure openssl is used
even in local build with other lilbraries available

[1.5.1-1]
- update to 1.5.1
- drop dependency on zlib-devel and bzip2-devel no more
referenced in libzip.pc
- drop rpath patch merged upstream

[1.5.0-2]
- add dependency on zlib-devel and bzip2-devel #1556068

[1.5.0-1]
- update to 1.5.0
- use openssl for cryptography instead of bundled custom AES implementation

[1.4.0-5]
- missing BR on C compiler
- use ldconfig_scriptlets

[1.4.0-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1.4.0-3]
- add upstream patch and drop multilib hack

[1.4.0-2]
- re-add multilib hack #1529886

php
[8.2.30-1]
- rebase to 8.2.30

php-pear
[1:1.10.14-1]
- update PEAR to 1.10.14 for PHP 8.2 RHEL-14705

[1:1.10.13-1]
- update PEAR to 1.10.13
- update Archive_Tar to 1.4.14

[1:1.10.12-1]
- update PEAR to 1.10.12
- update Archive_Tar to 1.4.9
- update Console_Getopt to 1.4.3
- update XML_Util to 1.4.5

[1:1.10.9-1]
- update PEAR to 1.10.9
- update Archive_Tar to 1.4.7
- update Console_Getopt to 1.4.2

[1:1.10.5-8]
- require /usr/bin/gpg instead of gnupg

[1:1.10.5-7]
- enable autoloader only in Fedora

[1:1.10.5-6]
- add patch for PHP 7.2 from
https://github.com/pear/pear-core/pull/71

[1:1.10.5-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1:1.10.5-4]
- add autoloader for each package

[1:1.10.5-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

php-pecl-apcu
[5.1.23-1]
- update to 5.1.23 for PHP 8.2 RHEL-14705

[5.1.20-1]
- update to 5.1.20

[5.1.18-1]
- update to 5.1.18

[5.1.17-1]
- update to 5.1.17

[5.1.12-1]
- update to 5.1.12 (stable)

[5.1.11-1]
- update to 5.1.11 (stable)

[5.1.10-1]
- update to 5.1.10 (stable)

[5.1.9-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[5.1.9-2]
- undefine _strict_symbol_defs_build

[5.1.9-1]
- Update to 5.1.9 (php 7, stable)

php-pecl-rrd
[2.0.3-1]
- update to 2.0.3

[2.0.1-1]
- build for RHEL 8

[2.0.1-13]
- rebuild for https://fedoraproject.org/wiki/Changes/php74

[2.0.1-12]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

[2.0.1-11]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

[2.0.1-10]
- Rebuild for https://fedoraproject.org/wiki/Changes/php73

[2.0.1-9]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

[2.0.1-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[2.0.1-7]
- undefine _strict_symbol_defs_build

[2.0.1-6]
- rebuild for https://fedoraproject.org/wiki/Changes/php72

php-pecl-xdebug3
[3.2.2-2]
- drop inet_ntoa usage using upstream patch

[3.2.2-1]
- update to 3.2.2 for PHP 8.2 RHEL-14705

[3.1.2-1]
- update to 3.1.2 rhbz#2030322

[3.0.4-5]
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688

[3.0.4-4]
- ignore tests relying on DNS #1979841

[3.0.4-2]
- Rebuilt for RHEL 9 BETA for openssl 3.0
Related: rhbz#1971065

[3.0.4-1]
- update to 3.0.4

[3.0.3-2]
- rebuild for https://fedoraproject.org/wiki/Changes/php80

[3.0.3-1]
- update to 3.0.3

[3.0.2-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

php-pecl-zip
[1.22.3-1]
- update to 1.22.3 for PHP 8.2 RHEL-14705

[1.19.2-1]
- update to 1.19.2

[1.18.2-1]
- update to 1.18.2

[1.15.4-1]
- Update to 1.15.4

[1.15.3-1]
- Update to 1.15.3

[1.15.2-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1.15.2-2]
- undefine _strict_symbol_defs_build

[1.15.2-1]
- Update to 1.15.2

[1.15.1-4]
- rebuild for https://fedoraproject.org/wiki/Changes/php72

[1.15.1-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

Fixed packages 35

ReleasePackageFixed in
Oracle Linux · 8 apcu-panel 0:5.1.23-1.module+el8.10.0+90469+8883f508
Oracle Linux · 8 libzip 0:1.7.3-1.module+el8.10.0+90469+8883f508
Oracle Linux · 8 libzip-devel 0:1.7.3-1.module+el8.10.0+90469+8883f508
Oracle Linux · 8 libzip-tools 0:1.7.3-1.module+el8.10.0+90469+8883f508
Oracle Linux · 8 php 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-bcmath 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-cli 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-common 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-dba 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-dbg 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-devel 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-embedded 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-enchant 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-ffi 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-fpm 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-gd 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-gmp 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-intl 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-ldap 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-mbstring 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-mysqlnd 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-odbc 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-opcache 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-pdo 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-pear 1:1.10.14-1.module+el8.10.0+90469+8883f508
Oracle Linux · 8 php-pecl-apcu 0:5.1.23-1.module+el8.10.0+90469+8883f508
Oracle Linux · 8 php-pecl-apcu-devel 0:5.1.23-1.module+el8.10.0+90469+8883f508
Oracle Linux · 8 php-pecl-rrd 0:2.0.3-1.module+el8.10.0+90469+8883f508
Oracle Linux · 8 php-pecl-xdebug3 0:3.2.2-2.module+el8.10.0+90469+8883f508
Oracle Linux · 8 php-pecl-zip 0:1.22.3-1.module+el8.10.0+90469+8883f508
Oracle Linux · 8 php-pgsql 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-process 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-snmp 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-soap 0:8.2.30-1.module+el8.10.0+90775+243071a5
Oracle Linux · 8 php-xml 0:8.2.30-1.module+el8.10.0+90775+243071a5

Vulnerabilities 6

  • High 8.2
    CVE-2025-14180

    NULL Pointer Dereference in PDO quoting

    In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared sta…

    PHP Group PHP php php8.1 Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2025-14178

    Heap buffer overflow in array_merge()

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to a…

    PHP Group PHP php7.2 php7.4 Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2025-14177 Public exploit

    Information Leak of Memory in getimagesize

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode …

    PHP Group PHP php php8.2 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2025-1735

    pgsql extension does not check for errors during escaping

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as inv…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2025-6491

    NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2025-1220

    Null byte termination in hostnames

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() t…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine