UbuntuUpdates.org

Package "php8.1-readline"

Name: php8.1-readline

Description:

readline module for PHP
Latest version: 8.1.2-1ubuntu2.28
Release: jammy (22.04)
Level: updates
Repository: main
Head package: php8.1
Homepage: http://www.php.net/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "php8.1-readline"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "php8.1-readline" in Jammy

Repository Area Version
base main 8.1.2-1ubuntu2
security main 8.1.2-1ubuntu2.28

Changelog

Version: 8.1.2-1ubuntu2.28 2026-10-21 17:09:16 UTC

php8.1 (8.1.2-1ubuntu2.28) jammy-security; urgency=medium

  * SECURITY UPDATE: Remote RCE via state corruption issue
    - debian/patches/CVE-2026-109618_109619.patch: Avoid state corruption via
      bailout in Zend/zend_API.h, Zend/zend_alloc.c, Zend/zend_alloc.h,
      Zend/zend_execute_API.c, Zend/zend_hash.c, Zend/zend_hash.h,
      Zend/zend_multiply.h, Zend/zend_strtod.c, Zend/zend_types.h,
      Zend/zend_vm_def.h, Zend/zend_vm_execute.h, ext/opcache/ZendAccelerator.c,
      ext/opcache/ZendAccelerator.h, ext/opcache/zend_file_cache.c,
      ext/opcache/zend_persist.c, ext/session/session.c,
      ext/zend_test/tests/observer_bug81430_2.phpt,
      ext/zend_test/tests/observer_bug81435.phpt,
      ext/zend_test/tests/observer_error_01.phpt, main/SAPI.c, main/main.c,
      main/php_variables.c, main/rfc1867.c.
    - CVE-2026-109618
    - CVE-2026-109619

 -- Marc Deslauriers Mon, 19 Oct 2026 14:54:45 -0400
Source diff to previous version

Version: 8.1.2-1ubuntu2.27 2026-10-21 09:07:37 UTC

php8.1 (8.1.2-1ubuntu2.27) jammy-security; urgency=medium

  * SECURITY UPDATE: heap buffer over-read in stream filter line-break-chars option
    - debian/patches/CVE-2026-92842.patch: Fix heap-buffer-overflow in convert
      stream filters with NUL in line-break-chars in ext/standard/filters.c,
      ext/standard/tests/filters/ghsa-88hq-2827-7pg6.phpt.
    - CVE-2026-92842
  * SECURITY UPDATE: FastCGI allowed_clients only matched /96 prefix of IPv6 addresses
    - debian/patches/CVE-2026-91768.patch: Fix GHSA-62xp-839h-2637: FastCGI
      allowed_clients compared only 96 bits of IPv6 addresses in main/fastcgi.c,
      sapi/fpm/tests/ghsa-62xp-839h-2637-ipv6-allowed-clients.phpt,
      sapi/fpm/tests/ghsa-62xp-839h-2637-v4mapped-allowed-clients.phpt.
    - CVE-2026-91768
  * SECURITY UPDATE: OpenSSL peer verification incorrectly fell back to CN
    - debian/patches/CVE-2026-91769.patch: Fix GHSA-vvx9-73fr-5jjx: do not fall
      back to CN if the cert has a service ID in
      ext/openssl/tests/san_absent_cn_fallback.phpt,
      ext/openssl/tests/san_no_cn_fallback.phpt,
      ext/openssl/tests/san_peer_matching.phpt,
      ext/openssl/tests/san_srv_no_cn_fallback.phpt,
      ext/openssl/tests/san_uri_no_cn_fallback.phpt, ext/openssl/xp_ssl.c.
    - CVE-2026-91769
  * SECURITY UPDATE: OOB read in wildcard certificate name matching
    - debian/patches/CVE-2026-91767.patch: Fix GHSA-xr7j-rvgx-xq5p: OOB read in
      php_openssl_matches_wildcard_name() in ext/openssl/tests/GHSA-xr7j-rvgx-
      xq5p.phpt, ext/openssl/xp_ssl.c.
    - CVE-2026-91767
  * SECURITY UPDATE: mysqlnd wire protocol parser OOB reads on truncated packets
    - debian/patches/CVE-2025-1218-pre.patch: Fix MySQLnd possible buffer over
      read in auth_protocol in ext/mysqlnd/mysqlnd_wireprotocol.c.
    - debian/patches/CVE-2025-1218.patch: Fix GHSA-r6x9-5r99-36j7: Various
      packet overreads in mysqlnd wireprotocol in
      ext/mysqli/tests/fake_server.inc,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-packet-affected-
      rows-2-bytes.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-packet-
      affected-rows-8-bytes.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-
      packet-affected-rows-null-length.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-packet-affected-rows.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-packet-last-insert-id-no-
      space.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-packet-last-insert-
      id.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-packet-warning-
      count.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-switch-
      unterminated.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-cached-
      sha2-empty.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-cached-sha2-fast-
      auth.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-cached-sha2-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-cached-sha2-switch-unterminated.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-chg-user-empty.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-chg-user-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-chg-user-switch-unterminated.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-eof-warning-count.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-greet-packet-string.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-greet-packet.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-greet-scramble-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-ok-packet-affected-rows.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-ok-packet-last-insert-id.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-ok-packet-message-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-ok-packet-warning-count.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-query-row-eof-short.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-query-row-field-len-2-bytes.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-query-row-field-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-query-row-field-null.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-rset-header-field-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-rset-header-upsert-affected-
      rows.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-rset-header-upsert-
      len.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-sha256-pk-empty.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-sha256-pk-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-stmt-response-field-len-faulty.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-stmt-response-field-len-
      premature.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-stmt-response-row-
      status.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-stmt-row-short-length-
      date.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-stmt-row-short-length-
      datetime.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-stmt-row-short-length-
      time.phpt, ext/mysqlnd/mysqlnd_ps.c, ext/mysqlnd/mysqlnd_ps_codec.c,
      ext/mysqlnd/mysqlnd_wireprotocol.c, ext/mysqlnd/mysqlnd_wireprotocol.h.
    - CVE-2025-1218
  * SECURITY UPDATE: HTTP stream wrapper leaks credentials to cross-origin redirects
    - debian/patches/CVE-2026-91766.patch: Fix GHSA-fpwc-w8rq-cr92: strip
      credentials from user headers on cross-origin redirects in
      ext/standard/http_fopen_wrapper.c, ext/standard/tests/http/bug61548.phpt,
      ext/standard/tests/http/ghsa-fpwc-w8rq-cr92.phpt.
    - CVE-2026-91766
  * SECURITY UPDATE: unbounded recursion in SOAP XML parser allows remote DoS
    - debian/patches/CVE-2026-91765.patch: Fix GHSA-rgrp-mwpx-f6rm: unbounded
      recursion in ext/soap XML parsing and decoding in ext/soap/php_encoding.c,
      ext/soap/php_soap.h, ext/soap/php_xml.c, ext/soap/soap.c,
      ext/soap/tests/GHSA-rgrp-mwpx-f6rm-href-chain.phpt, ext/soap/tests/GHSA-
      rgrp-mwpx-f6rm-href-cycle.phpt, ext/soap/tests/GHSA-rgrp-mwpx-f6rm.phpt.
    - CVE-2026-91765
  * SECURITY UPDATE: heap buffer overflow in SOAP HTTP client response buffer
    - debian/patches/CVE-2025-14181.patch: Fix GHSA-cj93-vc83-wgqv in
      ext/soap/php_http.c, ext/soap/tests/bugs/GHSA
Source diff to previous version
CVE-2026-92842 The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose
CVE-2026-91768 The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a
CVE-2026-91769 PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common
CVE-2026-91767 php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents
CVE-2025-1218 The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or
CVE-2026-91766 When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, eve
CVE-2026-91765 cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP reques
CVE-2025-14181 The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not g
CVE-2026-6103 phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds val
CVE-2026-93682 When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past

Version: 8.1.2-1ubuntu2.26 2026-09-10 16:07:42 UTC

php8.1 (8.1.2-1ubuntu2.26) jammy-security; urgency=medium

  * SECURITY UPDATE: SQL injection via improper escaping of backslashes
    - debian/patches/CVE-2026-17543.patch: Fix SQL injection in ext-pgsql via
      E'...' backslash breakout in ext/pgsql/pgsql.c,
      ext/pgsql/tests/10pg_convert_9.phpt,
      ext/pgsql/tests/10pg_convert_json_array.phpt,
      ext/pgsql/tests/12pg_insert_9.phpt, ext/pgsql/tests/14pg_update_9.phpt,
      ext/pgsql/tests/GHSA-7qpv-r5mr-78m4.phpt, ext/pgsql/tests/bug64609.phpt,
      ext/pgsql/tests/bug68638.phpt.
    - CVE-2026-17543
  * SECURITY UPDATE: DoS via circular symbolic links in phar archives
    - debian/patches/CVE-2026-7260.patch: Fix GHSA-vc5h-9ppw-p5f3: phar circular
      symlink crash in ext/phar/util.c.
    - CVE-2026-7260

 -- Marc Deslauriers Wed, 02 Sep 2026 08:42:10 -0400
Source diff to previous version
CVE-2026-17543 Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from
CVE-2026-7260 Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from

Version: 8.1.2-1ubuntu2.25 2026-07-20 21:08:41 UTC
No changelog available yet.
Source diff to previous version

Version: 8.1.2-1ubuntu2.24 2026-05-29 00:07:35 UTC

  php8.1 (8.1.2-1ubuntu2.24) jammy-security; urgency=medium

  * SECURITY UPDATE: SQL injection in PDO Firebird driver
    - debian/patches/CVE-2025-14179.patch: GHSA-w476-322c-wpvm: [pdo_firebird]
      Fix SQL injection via NUL bytes in quoted strings in
      ext/pdo_firebird/firebird_driver.c,
      ext/pdo_firebird/tests/ghsa-w476-322c-wpvm.phpt.
    - CVE-2025-14179
  * SECURITY UPDATE: use-after-free in SOAP extension
    - debian/patches/CVE-2026-6722.patch: GHSA-85c2-q967-79q5: [soap] Fix stale
      SOAP_GLOBAL(ref_map) pointer with Apache Map in ext/soap/php_encoding.c,
      ext/soap/tests/GHSA-85c2-q967-79q5.phpt.
    - CVE-2026-6722
  * SECURITY UPDATE: XSS via incorrect sanitizationc
    - debian/patches/CVE-2026-6735-pre1.patch: Expose JSON internal function
      to escape string in ext/json/json.c, ext/json/json_encoder.c,
      ext/json/php_json.h, ext/json/php_json_encoder.h.
    - debian/patches/CVE-2026-6735-pre2.patch: Fix bug #64539: FPM status -
      query_string not properly JSON encoded in sapi/fpm/fpm/fpm_status.c,
      sapi/fpm/tests/bug64539-status-json-encoding.phpt,
      sapi/fpm/tests/response.inc, sapi/fpm/tests/tester.inc.
    - debian/patches/CVE-2026-6735.patch: GHSA-7qg2-v9fj-4mwv: [fpm] XSS within
      status endpoint in sapi/fpm/fpm/fpm_status.c,
      sapi/fpm/tests/ghsa-7qg2-v9fj-4mwv-status-xss.phpt.
    - CVE-2026-6735
  * SECURITY UPDATE: null pointer dereference via encoding lists mismatch
    - debian/patches/CVE-2026-7259.patch: GHSA-wm6j-2649-pv75: [mbstring] Fix
      null pointer dereference in php_mb_check_encoding() via
      mb_ereg_search_init() in Zend/tests/GHSA-wm6j-2649-pv75.phpt,
      ext/mbstring/php_mbregex.c.
    - CVE-2026-7259
  * SECURITY UPDATE: use-after-free in SOAP persistance handling
    - debian/patches/CVE-2026-7261.patch: GHSA-m33r-qmcv-p97q: [soap] Fix use-
      after-free after header parsing failure with SOAP_PERSISTENCE_SESSION in
      ext/soap/soap.c, ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt.
    - CVE-2026-7261
  * SECURITY UPDATE: null pointer dereference in SOAP decoding process
    - debian/patches/CVE-2026-7262.patch: GHSA-hmxp-6pc4-f3vv: [soap] Fix broken
      Apache map value NULL check in ext/soap/php_encoding.c,
      ext/soap/tests/GHSA-hmxp-6pc4-f3vv.phpt.
    - CVE-2026-7262
  * SECURITY UPDATE: integer overflow in metaphone
    - debian/patches/CVE-2026-7568.patch: GHSA-96wq-48vp-hh57: [metaphone] Fix
      signed integer overflow of char array offset in ext/standard/metaphone.c,
      ext/standard/tests/GHSA-96wq-48vp-hh57.phpt.
    - CVE-2026-7568

 -- Marc Deslauriers <email address hidden> Mon, 25 May 2026 11:08:06 -0400
CVE-2025-14179 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL
CVE-2026-6722 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mech
CVE-2026-6735 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows
CVE-2026-7259 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma
CVE-2026-7261 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSIS
CVE-2026-7262 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, t
CVE-2026-7568 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metap


About   -   Send Feedback to @ubuntu_updates