Security update for php8
| Announcement ID: | SUSE-SU-2026:21612-1 |
|---|---|
| Release Date: | 2026-05-13T07:57:49Z |
| Rating: | critical |
| References: | |
| Cross-References: | |
| CVSS scores: |
|
| Affected Products: |
|
An update that solves 10 vulnerabilities can now be installed.
Description:
This update for php8 fixes the following issues
- CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries can lead to SQL injection (bsc#1264778).
- CVE-2026-6104: out-of-bounds read when processing an encoding name containing an embedded NULL byte in
mb_convert_encoding()can lead to information disclosure and denial of service (bsc#1264777). - CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).
- CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS (bsc#1264775).
- CVE-2026-7258: signed
charvalues passed toctypefunctions likeisxdigitcan lead to OOB access and denial of service (bsc#1264774). - CVE-2026-7259: NULL pointer dereference in
php_mb_check_encoding()viamb_ereg_search_init()can lead to a denial of service (bsc#1264773). - CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).
- CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured can lead to a denial of service (bsc#1264771).
- CVE-2026-7263: incorrect processing of XML data in the
DOMNode: C14N()method can lead to an infinite loop and a denial of service (bsc#1264770). - CVE-2026-7568: integer overflow in the
metaphonefunction can lead to undefined behavior and affect the availability of the PHPprocess (bsc#1264769).
Other updates:
- Updated to 8.4.21.
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Server 16.0
zypper in -t patch SUSE-SLES-16.0-738=1 -
SUSE Linux Enterprise Server for SAP applications 16.0
zypper in -t patch SUSE-SLES-16.0-738=1
Package List:
-
SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64)
- php8-fastcgi-debuginfo-8.4.21-160000.1.1
- php8-ctype-debuginfo-8.4.21-160000.1.1
- php8-sockets-debuginfo-8.4.21-160000.1.1
- php8-soap-debuginfo-8.4.21-160000.1.1
- php8-readline-debuginfo-8.4.21-160000.1.1
- php8-mysql-debuginfo-8.4.21-160000.1.1
- php8-sodium-debuginfo-8.4.21-160000.1.1
- php8-tidy-debuginfo-8.4.21-160000.1.1
- php8-snmp-8.4.21-160000.1.1
- php8-gmp-debuginfo-8.4.21-160000.1.1
- php8-xsl-debuginfo-8.4.21-160000.1.1
- php8-bz2-debuginfo-8.4.21-160000.1.1
- php8-bcmath-8.4.21-160000.1.1
- php8-tokenizer-debuginfo-8.4.21-160000.1.1
- php8-pcntl-8.4.21-160000.1.1
- php8-shmop-8.4.21-160000.1.1
- php8-fastcgi-8.4.21-160000.1.1
- php8-xmlwriter-8.4.21-160000.1.1
- apache2-mod_php8-8.4.21-160000.1.1
- php8-embed-debuginfo-8.4.21-160000.1.1
- php8-sodium-8.4.21-160000.1.1
- php8-embed-debugsource-8.4.21-160000.1.1
- php8-sqlite-8.4.21-160000.1.1
- php8-sysvmsg-8.4.21-160000.1.1
- php8-openssl-8.4.21-160000.1.1
- php8-phar-debuginfo-8.4.21-160000.1.1
- php8-zip-8.4.21-160000.1.1
- php8-ldap-debuginfo-8.4.21-160000.1.1
- php8-ffi-debuginfo-8.4.21-160000.1.1
- php8-xmlwriter-debuginfo-8.4.21-160000.1.1
- php8-dba-8.4.21-160000.1.1
- php8-gettext-debuginfo-8.4.21-160000.1.1
- php8-iconv-8.4.21-160000.1.1
- php8-opcache-debuginfo-8.4.21-160000.1.1
- php8-phar-8.4.21-160000.1.1
- php8-zlib-debuginfo-8.4.21-160000.1.1
- php8-intl-8.4.21-160000.1.1
- php8-sqlite-debuginfo-8.4.21-160000.1.1
- php8-sysvshm-debuginfo-8.4.21-160000.1.1
- php8-sysvmsg-debuginfo-8.4.21-160000.1.1
- php8-odbc-8.4.21-160000.1.1
- php8-dba-debuginfo-8.4.21-160000.1.1
- php8-debugsource-8.4.21-160000.1.1
- php8-mbstring-8.4.21-160000.1.1
- php8-xsl-8.4.21-160000.1.1
- php8-mysql-8.4.21-160000.1.1
- php8-shmop-debuginfo-8.4.21-160000.1.1
- php8-sockets-8.4.21-160000.1.1
- php8-gmp-8.4.21-160000.1.1
- php8-pdo-debuginfo-8.4.21-160000.1.1
- php8-dom-8.4.21-160000.1.1
- php8-ftp-8.4.21-160000.1.1
- php8-iconv-debuginfo-8.4.21-160000.1.1
- php8-odbc-debuginfo-8.4.21-160000.1.1
- php8-sysvsem-8.4.21-160000.1.1
- php8-readline-8.4.21-160000.1.1
- php8-gettext-8.4.21-160000.1.1
- php8-fastcgi-debugsource-8.4.21-160000.1.1
- php8-zip-debuginfo-8.4.21-160000.1.1
- php8-fpm-debuginfo-8.4.21-160000.1.1
- php8-openssl-debuginfo-8.4.21-160000.1.1
- php8-fileinfo-8.4.21-160000.1.1
- php8-curl-8.4.21-160000.1.1
- php8-ldap-8.4.21-160000.1.1
- php8-enchant-debuginfo-8.4.21-160000.1.1
- php8-calendar-debuginfo-8.4.21-160000.1.1
- php8-xmlreader-8.4.21-160000.1.1
- php8-bcmath-debuginfo-8.4.21-160000.1.1
- php8-pdo-8.4.21-160000.1.1
- php8-fileinfo-debuginfo-8.4.21-160000.1.1
- php8-gd-debuginfo-8.4.21-160000.1.1
- php8-pcntl-debuginfo-8.4.21-160000.1.1
- php8-exif-8.4.21-160000.1.1
- php8-embed-8.4.21-160000.1.1
- php8-fpm-debugsource-8.4.21-160000.1.1
- php8-posix-8.4.21-160000.1.1
- php8-ffi-8.4.21-160000.1.1
- php8-cli-8.4.21-160000.1.1
- php8-curl-debuginfo-8.4.21-160000.1.1
- php8-bz2-8.4.21-160000.1.1
- php8-enchant-8.4.21-160000.1.1
- php8-ftp-debuginfo-8.4.21-160000.1.1
- php8-sysvshm-8.4.21-160000.1.1
- php8-intl-debuginfo-8.4.21-160000.1.1
- php8-ctype-8.4.21-160000.1.1
- php8-sysvsem-debuginfo-8.4.21-160000.1.1
- php8-pgsql-debuginfo-8.4.21-160000.1.1
- apache2-mod_php8-debuginfo-8.4.21-160000.1.1
- php8-zlib-8.4.21-160000.1.1
- php8-dom-debuginfo-8.4.21-160000.1.1
- php8-fpm-8.4.21-160000.1.1
- php8-opcache-8.4.21-160000.1.1
- php8-posix-debuginfo-8.4.21-160000.1.1
- php8-debuginfo-8.4.21-160000.1.1
- php8-calendar-8.4.21-160000.1.1
- php8-devel-8.4.21-160000.1.1
- php8-soap-8.4.21-160000.1.1
- php8-tidy-8.4.21-160000.1.1
- php8-cli-debuginfo-8.4.21-160000.1.1
- php8-tokenizer-8.4.21-160000.1.1
- php8-exif-debuginfo-8.4.21-160000.1.1
- php8-snmp-debuginfo-8.4.21-160000.1.1
- apache2-mod_php8-debugsource-8.4.21-160000.1.1
- php8-8.4.21-160000.1.1
- php8-gd-8.4.21-160000.1.1
- php8-xmlreader-debuginfo-8.4.21-160000.1.1
- php8-mbstring-debuginfo-8.4.21-160000.1.1
- php8-pgsql-8.4.21-160000.1.1
-
SUSE Linux Enterprise Server 16.0 (noarch)
- php8-fpm-apache-8.4.21-160000.1.1
-
SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64)
- php8-fastcgi-debuginfo-8.4.21-160000.1.1
- php8-ctype-debuginfo-8.4.21-160000.1.1
- php8-sockets-debuginfo-8.4.21-160000.1.1
- php8-mysql-debuginfo-8.4.21-160000.1.1
- php8-readline-debuginfo-8.4.21-160000.1.1
- php8-soap-debuginfo-8.4.21-160000.1.1
- php8-sodium-debuginfo-8.4.21-160000.1.1
- php8-tidy-debuginfo-8.4.21-160000.1.1
- php8-snmp-8.4.21-160000.1.1
- php8-gmp-debuginfo-8.4.21-160000.1.1
- php8-xsl-debuginfo-8.4.21-160000.1.1
- php8-bz2-debuginfo-8.4.21-160000.1.1
- php8-bcmath-8.4.21-160000.1.1
- php8-tokenizer-debuginfo-8.4.21-160000.1.1
- php8-pcntl-8.4.21-160000.1.1
- php8-shmop-8.4.21-160000.1.1
- php8-fastcgi-8.4.21-160000.1.1
- php8-embed-debuginfo-8.4.21-160000.1.1
- php8-xmlwriter-8.4.21-160000.1.1
- apache2-mod_php8-8.4.21-160000.1.1
- php8-sodium-8.4.21-160000.1.1
- php8-embed-debugsource-8.4.21-160000.1.1
- php8-openssl-8.4.21-160000.1.1
- php8-sqlite-8.4.21-160000.1.1
- php8-sysvmsg-8.4.21-160000.1.1
- php8-phar-debuginfo-8.4.21-160000.1.1
- php8-zip-8.4.21-160000.1.1
- php8-ldap-debuginfo-8.4.21-160000.1.1
- php8-ffi-debuginfo-8.4.21-160000.1.1
- php8-xmlwriter-debuginfo-8.4.21-160000.1.1
- php8-dba-8.4.21-160000.1.1
- php8-gettext-debuginfo-8.4.21-160000.1.1
- php8-iconv-8.4.21-160000.1.1
- php8-opcache-debuginfo-8.4.21-160000.1.1
- php8-phar-8.4.21-160000.1.1
- php8-zlib-debuginfo-8.4.21-160000.1.1
- php8-intl-8.4.21-160000.1.1
- php8-sqlite-debuginfo-8.4.21-160000.1.1
- php8-sysvshm-debuginfo-8.4.21-160000.1.1
- php8-odbc-8.4.21-160000.1.1
- php8-sysvmsg-debuginfo-8.4.21-160000.1.1
- php8-dba-debuginfo-8.4.21-160000.1.1
- php8-debugsource-8.4.21-160000.1.1
- php8-mbstring-8.4.21-160000.1.1
- php8-xsl-8.4.21-160000.1.1
- php8-mysql-8.4.21-160000.1.1
- php8-shmop-debuginfo-8.4.21-160000.1.1
- php8-gmp-8.4.21-160000.1.1
- php8-sockets-8.4.21-160000.1.1
- php8-pdo-debuginfo-8.4.21-160000.1.1
- php8-dom-8.4.21-160000.1.1
- php8-ftp-8.4.21-160000.1.1
- php8-iconv-debuginfo-8.4.21-160000.1.1
- php8-odbc-debuginfo-8.4.21-160000.1.1
- php8-sysvsem-8.4.21-160000.1.1
- php8-readline-8.4.21-160000.1.1
- php8-gettext-8.4.21-160000.1.1
- php8-fastcgi-debugsource-8.4.21-160000.1.1
- php8-zip-debuginfo-8.4.21-160000.1.1
- php8-fpm-debuginfo-8.4.21-160000.1.1
- php8-openssl-debuginfo-8.4.21-160000.1.1
- php8-fileinfo-8.4.21-160000.1.1
- php8-curl-8.4.21-160000.1.1
- php8-ldap-8.4.21-160000.1.1
- php8-enchant-debuginfo-8.4.21-160000.1.1
- php8-calendar-debuginfo-8.4.21-160000.1.1
- php8-xmlreader-8.4.21-160000.1.1
- php8-bcmath-debuginfo-8.4.21-160000.1.1
- php8-pdo-8.4.21-160000.1.1
- php8-fileinfo-debuginfo-8.4.21-160000.1.1
- php8-gd-debuginfo-8.4.21-160000.1.1
- php8-exif-8.4.21-160000.1.1
- php8-pcntl-debuginfo-8.4.21-160000.1.1
- php8-embed-8.4.21-160000.1.1
- php8-fpm-debugsource-8.4.21-160000.1.1
- php8-posix-8.4.21-160000.1.1
- php8-ffi-8.4.21-160000.1.1
- php8-cli-8.4.21-160000.1.1
- php8-curl-debuginfo-8.4.21-160000.1.1
- php8-bz2-8.4.21-160000.1.1
- php8-enchant-8.4.21-160000.1.1
- php8-ftp-debuginfo-8.4.21-160000.1.1
- php8-sysvshm-8.4.21-160000.1.1
- php8-intl-debuginfo-8.4.21-160000.1.1
- php8-ctype-8.4.21-160000.1.1
- php8-sysvsem-debuginfo-8.4.21-160000.1.1
- php8-pgsql-debuginfo-8.4.21-160000.1.1
- apache2-mod_php8-debuginfo-8.4.21-160000.1.1
- php8-zlib-8.4.21-160000.1.1
- php8-dom-debuginfo-8.4.21-160000.1.1
- php8-opcache-8.4.21-160000.1.1
- php8-fpm-8.4.21-160000.1.1
- php8-posix-debuginfo-8.4.21-160000.1.1
- php8-debuginfo-8.4.21-160000.1.1
- php8-calendar-8.4.21-160000.1.1
- php8-devel-8.4.21-160000.1.1
- php8-soap-8.4.21-160000.1.1
- php8-tidy-8.4.21-160000.1.1
- php8-cli-debuginfo-8.4.21-160000.1.1
- php8-tokenizer-8.4.21-160000.1.1
- php8-exif-debuginfo-8.4.21-160000.1.1
- php8-snmp-debuginfo-8.4.21-160000.1.1
- apache2-mod_php8-debugsource-8.4.21-160000.1.1
- php8-8.4.21-160000.1.1
- php8-gd-8.4.21-160000.1.1
- php8-xmlreader-debuginfo-8.4.21-160000.1.1
- php8-mbstring-debuginfo-8.4.21-160000.1.1
- php8-pgsql-8.4.21-160000.1.1
-
SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
- php8-fpm-apache-8.4.21-160000.1.1
References:
- https://www.suse.com/security/cve/CVE-2025-14179.html
- https://www.suse.com/security/cve/CVE-2026-6104.html
- https://www.suse.com/security/cve/CVE-2026-6722.html
- https://www.suse.com/security/cve/CVE-2026-6735.html
- https://www.suse.com/security/cve/CVE-2026-7258.html
- https://www.suse.com/security/cve/CVE-2026-7259.html
- https://www.suse.com/security/cve/CVE-2026-7261.html
- https://www.suse.com/security/cve/CVE-2026-7262.html
- https://www.suse.com/security/cve/CVE-2026-7263.html
- https://www.suse.com/security/cve/CVE-2026-7568.html
- https://bugzilla.suse.com/show_bug.cgi?id=1264769
- https://bugzilla.suse.com/show_bug.cgi?id=1264770
- https://bugzilla.suse.com/show_bug.cgi?id=1264771
- https://bugzilla.suse.com/show_bug.cgi?id=1264772
- https://bugzilla.suse.com/show_bug.cgi?id=1264773
- https://bugzilla.suse.com/show_bug.cgi?id=1264774
- https://bugzilla.suse.com/show_bug.cgi?id=1264775
- https://bugzilla.suse.com/show_bug.cgi?id=1264776
- https://bugzilla.suse.com/show_bug.cgi?id=1264777
- https://bugzilla.suse.com/show_bug.cgi?id=1264778