php8.2 (8.2.34-1~deb12u1) bookworm-security; urgency=high

php8.2 (8.2.34-1~deb12u1) bookworm-security; urgency=high

  * Non-maintainer upload by the LTS Team.
  * New upstream version 8.2.34:
    + [MySQLnd] Fix CVE-2025-1218: Various packet overreads in mysqlnd wire
      protocol.
    + [SOAP] Fix CVE-2025-14181: Integer overflow to buffer overflow in SOAP
      HTTP parsing.
    + [Phar] Fix CVE-2026-6103: Phar TAR phar_tar_number() Integer Overflow
      allowing Archive Entry Injection.
    + [SOAP] Fix CVE-2026-91765: Unbounded recursion in server-side
      cleanup_xml_node().
    + Fix CVE-2026-91766: Cross-origin credential leak in HTTP stream wrapper
      redirects.
    + [OpenSSL] Fix CVE-2026-91767: Heap-buffer-overflow in
      php_openssl_matches_wildcard_name() on crafted server cert wildcard CN.
    + [FPM] Fix CVE-2026-91768: IPv6 ACL bypass in FastCGI
      listen.allowed_clients due to partial address comparison.
    + [OpenSSL] Fix CVE-2026-91769: TLS hostname verification falls back to CN
      after SAN Mismatch.
    + Fix CVE-2026-92842: OOB read / info leak in convert.* stream filters
      when line-break-chars contains NUL.
    + Fix CVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when
      following a redirect with an empty Location header.
    + [Filter] Fix Encode 0xFF in FILTER_SANITIZE_ENCODED.
  * Refresh d/patches.

[dgit import unpatched php8.2 8.2.34-1~deb12u1]