ELSA-2026-87080

libzip [1.6.1-1] - update to 1.6.1 - enable lzma support [1.5.2-1] - update to 1.5.2 - add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available [1.5.1-1] - update to 1.5.1 - drop dependency on zlib-devel and bzip2-devel no more referenced in libzip.pc - drop rpath patch merged upstream [1.5.0-2] - add dependency on zlib-devel and bzip2-devel #1556068 [1.5.0-1] - update to 1.5.0 - use openssl for cryptography instead of bundled custom AES implementation [1.4.0-5] - missing BR on C compiler - use ldconfig_scriptlets [1.4.0-4] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [1.4.0-3] - add upstream patch and drop multilib hack [1.4.0-2] - re-add multilib hack #1529886 [1.4.0-1] - update to 1.4.0 - switch to cmake - add upstream patch for lib64 php [7.4.33-8] - Avoid state corruption via bailout CVE-2026-109618, CVE-2026-109619 [7.4.33-7] - Fix FILTER_SANITIZE_ENCODED does not encode 0xFF - Fix IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison CVE-2026-91768 - Fixed Various packet overreads in mysqlnd wire protocol CVE-2025-1218 - Fix TLS hostname verification falls back to CN after SAN mismatch CVE-2026-91769 - Fix Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN CVE-2026-91767 - Fix Integer overflow in phar_tar_number() allowing TAR archive entry injection CVE-2026-6103 - Fix Unbounded recursion in server-side cleanup_xml_node() CVE-2026-91765 - Fix Integer overflow to buffer overflow in SOAP HTTP parsing CVE-2025-14181 - Fix Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL CVE-2026-92842 - Fix Cross-origin credential leak in HTTP stream wrapper redirects CVE-2026-91766 - Fix Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header CVE-2026-93682 [7.4.33-6] - Fix leak on double DatePeriod::__construct() call - Fixed SQL injection via E'...' backslash breakout CVE-2026-17543 - Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks CVE-2026-7260 [7.4.33-5] - Fix Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD CVE-2026-14355 [7.4.33-4] - Fix XSS within status endpoint CVE-2026-6735 - Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map CVE-2026-6722 - Fix Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION CVE-2026-7261 - Fix Broken Apache map value NULL check CVE-2026-7262 - Fix Signed integer overflow of char array offset CVE-2026-7568 - Fix Consistently pass unsigned char to ctype.h functions CVE-2026-7258 [7.4.33-3] - Fix Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface GHSA-4w77-75f9-2c8w - Fix Configuring a proxy in a stream context might allow for CRLF injection in URIs CVE-2024-11234 - Fix Single byte overread with convert.quoted-printable-decode filter CVE-2024-11233 - Fix Leak partial content of the heap through heap buffer over-read CVE-2024-8929 - Fix libxml streams use wrong content-type header when requesting a redirected resource CVE-2025-1219 - Fix Stream HTTP wrapper header check might omit basic auth header CVE-2025-1736 - Fix Stream HTTP wrapper truncate redirect location to 1024 bytes CVE-2025-1861 - Fix Streams HTTP wrapper does not fail for headers without colon CVE-2025-1734 - Fix Header parser of http stream wrapper does not handle folded headers CVE-2025-1217 - Fix pgsql extension does not check for errors during escaping CVE-2025-1735 - Fix NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix CVE-2025-6491 - Fix Null byte termination in hostnames CVE-2025-1220 - Fix Null byte termination in dns_get_record() GHSA-www2-q4fc-65wf - Fix Heap buffer overflow in array_merge() CVE-2025-14178 - Fix Information Leak of Memory in getimagesize CVE-2025-14177 [7.4.33-2] - fix low/moderate CVEs RHEL-66589 - Fix cgi.force_redirect configuration is bypassable due to the environment variable collision CVE-2024-8927 - Fix Logs from childrens may be altered CVE-2024-9026 - Fix Erroneous parsing of multipart form data CVE-2024-8925 - Fix filter bypass in filter_var FILTER_VALIDATE_URL CVE-2024-5458 - Fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix CVE-2024-2756 - Fix password_verify can erroneously return true opening ATO risk CVE-2024-3096 - Fix Security issue with external entity loading in XML without enabling it CVE-2023-3823 - Fix Buffer mismanagement in phar_dir_read() CVE-2023-3824 - Fix Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP CVE-2023-3247 - fix #81744: Password_verify() always return true with some hash CVE-2023-0567 - fix #81746: 1-byte array overrun in common path resolve code CVE-2023-0568 - fix DOS vulnerability when parsing multipart request body CVE-2023-0662 [7.4.33-1] - rebase to 7.4.33 - fix: due to an integer overflow PDO::quote() may return unquoted string CVE-2022-31631 [7.4.30-1] - rebase to 7.4.30 #2099615 [7.4.19-3] - fix password of excessive length triggers buffer overflow leading to RCE CVE-2022-31626 php-pear [1:1.10.13-1] - update PEAR to 1.10.13 - update Archive_Tar to 1.4.14 [1:1.10.12-1] - update PEAR to 1.10.12 - update Archive_Tar to 1.4.9 - update Console_Getopt to 1.4.3 - update XML_Util to 1.4.5 [1:1.10.9-1] - update PEAR to 1.10.9 - update Archive_Tar to 1.4.7 - update Console_Getopt to 1.4.2 [1:1.10.5-8] - require /usr/bin/gpg instead of gnupg [1:1.10.5-7] - enable autoloader only in Fedora [1:1.10.5-6] - add patch for PHP 7.2 from https://github.com/pear/pear-core/pull/71 [1:1.10.5-5] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [1:1.10.5-4] - add autoloader for each package [1:1.10.5-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild [1:1.10.5-2] - update XML_Util to 1.4.3 (no change) php-pecl-apcu [5.1.18-1] - update to 5.1.18 [5.1.17-1] - update to 5.1.17 [5.1.12-1] - update to 5.1.12 (stable) [5.1.11-1] - update to 5.1.11 (stable) [5.1.10-1] - update to 5.1.10 (stable) [5.1.9-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [5.1.9-2] - undefine _strict_symbol_defs_build [5.1.9-1] - Update to 5.1.9 (php 7, stable) [5.1.8-5] - rebuild for https://fedoraproject.org/wiki/Changes/php72 [5.1.8-4] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild php-pecl-rrd [2.0.1-1] - build for RHEL 8 [2.0.1-13] - rebuild for https://fedoraproject.org/wiki/Changes/php74 [2.0.1-12] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild [2.0.1-11] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild [2.0.1-10] - Rebuild for https://fedoraproject.org/wiki/Changes/php73 [2.0.1-9] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild [2.0.1-8] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [2.0.1-7] - undefine _strict_symbol_defs_build [2.0.1-6] - rebuild for https://fedoraproject.org/wiki/Changes/php72 [2.0.1-5] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild php-pecl-xdebug [2.9.5-1] - update to 2.9.5 [2.8.0-1] - build for RHEL 8 #1769857 [2.8.0-1] - update to 2.8.0 [2.7.2-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild [2.7.2-1] - update to 2.7.2 [2.7.1-1] - update to 2.7.1 [2.7.0-1] - update to 2.7.0 (stable) [2.7.0-0.3.RC2] - update to 2.7.0RC2 [2.7.0-0.2.rc1] - update to 2.7.0RC1 [2.7.0-0.1.beta1.1] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild php-pecl-zip [1.18.2-1] - update to 1.18.2 [1.15.4-1] - Update to 1.15.4 [1.15.3-1] - Update to 1.15.3 [1.15.2-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [1.15.2-2] - undefine _strict_symbol_defs_build [1.15.2-1] - Update to 1.15.2 [1.15.1-4] - rebuild for https://fedoraproject.org/wiki/Changes/php72 [1.15.1-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild [1.15.1-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild [1.15.1-1] - Update to 1.15.1