Bugs fixes in "php8.5"
| Origin | Bug number | Title | Date fixed |
|---|---|---|---|
| CVE | CVE-2026-93682 | When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past | 2026-10-19 |
| CVE | CVE-2026-6103 | phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds val | 2026-10-19 |
| CVE | CVE-2025-14181 | The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not g | 2026-10-19 |
| CVE | CVE-2026-91765 | cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP reques | 2026-10-19 |
| CVE | CVE-2026-91766 | When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, eve | 2026-10-19 |
| CVE | CVE-2025-1218 | The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or | 2026-10-19 |
| CVE | CVE-2026-91767 | php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents | 2026-10-19 |
| CVE | CVE-2026-91769 | PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common | 2026-10-19 |
| CVE | CVE-2026-91768 | The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a | 2026-10-19 |
| CVE | CVE-2026-92842 | The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose | 2026-10-19 |
| CVE | CVE-2026-93682 | When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past | 2026-10-19 |
| CVE | CVE-2026-6103 | phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds val | 2026-10-19 |
| CVE | CVE-2025-14181 | The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not g | 2026-10-19 |
| CVE | CVE-2026-91765 | cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP reques | 2026-10-19 |
| CVE | CVE-2026-91766 | When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, eve | 2026-10-19 |
| CVE | CVE-2025-1218 | The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or | 2026-10-19 |
| CVE | CVE-2026-91767 | php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents | 2026-10-19 |
| CVE | CVE-2026-91769 | PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common | 2026-10-19 |
| CVE | CVE-2026-91768 | The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a | 2026-10-19 |
| CVE | CVE-2026-92842 | The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose | 2026-10-19 |
About
-
Send Feedback to @ubuntu_updates
