Bugs fixes in "php8.5"
| Origin | Bug number | Title | Date fixed |
|---|---|---|---|
| CVE | CVE-2026-7260 | Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from | 2026-09-10 |
| CVE | CVE-2026-17544 | Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and | 2026-09-10 |
| CVE | CVE-2026-17543 | Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from | 2026-09-10 |
| CVE | CVE-2026-7260 | Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from | 2026-09-10 |
| CVE | CVE-2026-17544 | Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and | 2026-09-10 |
| CVE | CVE-2026-17543 | Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from | 2026-09-10 |
| CVE | CVE-2026-7260 | Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from | 2026-09-10 |
| CVE | CVE-2026-17544 | Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and | 2026-09-10 |
| CVE | CVE-2026-17543 | Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from | 2026-09-10 |
| CVE | CVE-2026-7260 | Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from | 2026-09-10 |
| CVE | CVE-2026-17544 | Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and | 2026-09-10 |
| CVE | CVE-2026-17543 | Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from | 2026-09-10 |
| CVE | CVE-2026-7568 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metap | 2026-05-29 |
| CVE | CVE-2026-7263 | In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked li | 2026-05-29 |
| CVE | CVE-2026-7262 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, t | 2026-05-29 |
| CVE | CVE-2026-7261 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSIS | 2026-05-29 |
| CVE | CVE-2026-7259 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma | 2026-05-29 |
| CVE | CVE-2026-7258 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass si | 2026-05-29 |
| CVE | CVE-2026-6735 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows | 2026-05-29 |
| CVE | CVE-2026-6722 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mech | 2026-05-29 |
About
-
Send Feedback to @ubuntu_updates
