Summary
libzip
[1.6.1-1]
- update to 1.6.1
- enable lzma support
[1.5.2-1]
- update to 1.5.2
- add all explicit cmake options to ensure openssl is used
even in local build with other lilbraries available
[1.5.1-1]
- update to 1.5.1
- drop dependency on zlib-devel and bzip2-devel no more
referenced in libzip.pc
- drop rpath patch merged upstream
[1.5.0-2]
- add dependency on zlib-devel and bzip2-devel #1556068
[1.5.0-1]
- update to 1.5.0
- use openssl for cryptography instead of bundled custom AES implementation
[1.4.0-5]
- missing BR on C compiler
- use ldconfig_scriptlets
[1.4.0-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
[1.4.0-3]
- add upstream patch and drop multilib hack
[1.4.0-2]
- re-add multilib hack #1529886
[1.4.0-1]
- update to 1.4.0
- switch to cmake
- add upstream patch for lib64
php
[7.4.33-8]
- Avoid state corruption via bailout
CVE-2026-109618, CVE-2026-109619
[7.4.33-7]
- Fix FILTER_SANITIZE_ENCODED does not encode 0xFF
- Fix IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison
CVE-2026-91768
- Fixed Various packet overreads in mysqlnd wire protocol
CVE-2025-1218
- Fix TLS hostname verification falls back to CN after SAN mismatch
CVE-2026-91769
- Fix Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN
CVE-2026-91767
- Fix Integer overflow in phar_tar_number() allowing TAR archive entry injection
CVE-2026-6103
- Fix Unbounded recursion in server-side cleanup_xml_node()
CVE-2026-91765
- Fix Integer overflow to buffer overflow in SOAP HTTP parsing
CVE-2025-14181
- Fix Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL
CVE-2026-92842
- Fix Cross-origin credential leak in HTTP stream wrapper redirects
CVE-2026-91766
- Fix Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
CVE-2026-93682
[7.4.33-6]
- Fix leak on double DatePeriod::__construct() call
- Fixed SQL injection via E'...' backslash breakout
CVE-2026-17543
- Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks
CVE-2026-7260
[7.4.33-5]
- Fix Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
CVE-2026-14355
[7.4.33-4]
- Fix XSS within status endpoint
CVE-2026-6735
- Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map
CVE-2026-6722
- Fix Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION
CVE-2026-7261
- Fix Broken Apache map value NULL check
CVE-2026-7262
- Fix Signed integer overflow of char array offset
CVE-2026-7568
- Fix Consistently pass unsigned char to ctype.h functions
CVE-2026-7258
[7.4.33-3]
- Fix Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface
GHSA-4w77-75f9-2c8w
- Fix Configuring a proxy in a stream context might allow for CRLF injection in URIs
CVE-2024-11234
- Fix Single byte overread with convert.quoted-printable-decode filter
CVE-2024-11233
- Fix Leak partial content of the heap through heap buffer over-read
CVE-2024-8929
- Fix libxml streams use wrong content-type header when requesting a redirected resource
CVE-2025-1219
- Fix Stream HTTP wrapper header check might omit basic auth header
CVE-2025-1736
- Fix Stream HTTP wrapper truncate redirect location to 1024 bytes
CVE-2025-1861
- Fix Streams HTTP wrapper does not fail for headers without colon
CVE-2025-1734
- Fix Header parser of http stream wrapper does not handle folded headers
CVE-2025-1217
- Fix pgsql extension does not check for errors during escaping
CVE-2025-1735
- Fix NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
CVE-2025-6491
- Fix Null byte termination in hostnames
CVE-2025-1220
- Fix Null byte termination in dns_get_record()
GHSA-www2-q4fc-65wf
- Fix Heap buffer overflow in array_merge()
CVE-2025-14178
- Fix Information Leak of Memory in getimagesize
CVE-2025-14177
[7.4.33-2]
- fix low/moderate CVEs
RHEL-66589
- Fix cgi.force_redirect configuration is bypassable due to the environment variable collision
CVE-2024-8927
- Fix Logs from childrens may be altered
CVE-2024-9026
- Fix Erroneous parsing of multipart form data
CVE-2024-8925
- Fix filter bypass in filter_var FILTER_VALIDATE_URL
CVE-2024-5458
- Fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
CVE-2024-2756
- Fix password_verify can erroneously return true opening ATO risk
CVE-2024-3096
- Fix Security issue with external entity loading in XML without enabling it
CVE-2023-3823
- Fix Buffer mismanagement in phar_dir_read()
CVE-2023-3824
- Fix Missing error check and insufficient random bytes in HTTP Digest
authentication for SOAP
CVE-2023-3247
- fix #81744: Password_verify() always return true with some hash
CVE-2023-0567
- fix #81746: 1-byte array overrun in common path resolve code
CVE-2023-0568
- fix DOS vulnerability when parsing multipart request body
CVE-2023-0662
[7.4.33-1]
- rebase to 7.4.33
- fix: due to an integer overflow PDO::quote() may return unquoted string
CVE-2022-31631
[7.4.30-1]
- rebase to 7.4.30 #2099615
[7.4.19-3]
- fix password of excessive length triggers buffer overflow leading to RCE
CVE-2022-31626
php-pear
[1:1.10.13-1]
- update PEAR to 1.10.13
- update Archive_Tar to 1.4.14
[1:1.10.12-1]
- update PEAR to 1.10.12
- update Archive_Tar to 1.4.9
- update Console_Getopt to 1.4.3
- update XML_Util to 1.4.5
[1:1.10.9-1]
- update PEAR to 1.10.9
- update Archive_Tar to 1.4.7
- update Console_Getopt to 1.4.2
[1:1.10.5-8]
- require /usr/bin/gpg instead of gnupg
[1:1.10.5-7]
- enable autoloader only in Fedora
[1:1.10.5-6]
- add patch for PHP 7.2 from
https://github.com/pear/pear-core/pull/71
[1:1.10.5-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
[1:1.10.5-4]
- add autoloader for each package
[1:1.10.5-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
[1:1.10.5-2]
- update XML_Util to 1.4.3 (no change)
php-pecl-apcu
[5.1.18-1]
- u
Fixed packages 37
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | apcu-panel | 0:5.1.18-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | libzip | 0:1.6.1-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | libzip-devel | 0:1.6.1-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | libzip-tools | 0:1.6.1-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-bcmath | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-cli | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-common | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-dba | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-dbg | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-devel | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-embedded | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-enchant | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-ffi | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-fpm | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-gd | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-gmp | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-intl | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-json | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-ldap | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-mbstring | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-mysqlnd | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-odbc | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-opcache | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-pdo | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-pear | 1:1.10.13-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pecl-apcu | 0:5.1.18-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pecl-apcu-devel | 0:5.1.18-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pecl-rrd | 0:2.0.1-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pecl-xdebug | 0:2.9.5-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pecl-zip | 0:1.18.2-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pgsql | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-process | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-snmp | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-soap | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-xml | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
| Oracle Linux · 8 | php-xmlrpc | 0:7.4.33-8.module+el8.10.0+91080+9785160d |
Vulnerabilities 12
-
Critical 9.2
RCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…
KEV Oct 26, 2026 -
Critical 9.2
RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…
KEV Oct 26, 2026 -
High 7.5
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the …
-
Medium 6.5
Integer overflow to buffer overflow in soap HTTP parsing
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a…
-
Medium 6.5
Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious ser…
-
Medium 6.5
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with…
-
Medium 5.9
Cross-origin credential leak in HTTP stream wrapper redirects
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server …
-
Medium 5.9
OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup…
-
Medium 5.8
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect …
-
Medium 4.3
Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of da…
-
Medium 4.3
TLS Hostname Verification Falls Back to CN After SAN Mismatch
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certifi…
-
Low 3.4
Various packet overreads in mysqlnd_writeprotocol.c
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buff…