From: Raspbian automatic forward porter Date: Thu, 22 Oct 2026 18:01:56 +0000 (+0100) Subject: Merge version 8.2.7-1~deb12u1+rpi1 and 8.2.35-1~deb12u1 to produce 8.2.35-1~deb12u1... X-Git-Tag: archive/raspbian/8.2.35-1_deb12u1+rpi1^0 X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=0aeb3a4b9a58c24f27fbe6c5bd938ae67a819cd4;p=php8.2.git Merge version 8.2.7-1~deb12u1+rpi1 and 8.2.35-1~deb12u1 to produce 8.2.35-1~deb12u1+rpi1 --- 0aeb3a4b9a58c24f27fbe6c5bd938ae67a819cd4 diff --cc debian/changelog index a8dbcf3e,29f77134..8279a249 --- a/debian/changelog +++ b/debian/changelog @@@ -1,8 -1,182 +1,189 @@@ - php8.2 (8.2.7-1~deb12u1+rpi1) bookworm-staging; urgency=medium ++php8.2 (8.2.35-1~deb12u1+rpi1) bookworm-staging; urgency=medium + ++ [changes brought forward from 8.2.7-1~deb12u1+rpi1 by Peter Michael Green at Thu, 20 Jul 2023 18:02:54 +0000] + * Fix fpu setting for raspbian. + - -- Peter Michael Green Thu, 20 Jul 2023 18:02:54 +0000 ++ -- Raspbian forward porter Thu, 22 Oct 2026 18:01:55 +0000 ++ + php8.2 (8.2.35-1~deb12u1) bookworm-security; urgency=high + + * Non-maintainer upload by the LTS Team. + * New upstream version 8.2.35: + + Fix CVE-2026-109618 and CVE-2026-109619: State corruption via bailout. + * Refresh d/patches. + + -- Guilhem Moulin Wed, 21 Oct 2026 08:29:51 +0200 + + php8.2 (8.2.34-1~deb12u1) bookworm-security; urgency=high + + * Non-maintainer upload by the LTS Team. + * New upstream version 8.2.34: + + [MySQLnd] Fix CVE-2025-1218: Various packet overreads in mysqlnd wire + protocol. + + [SOAP] Fix CVE-2025-14181: Integer overflow to buffer overflow in SOAP + HTTP parsing. + + [Phar] Fix CVE-2026-6103: Phar TAR phar_tar_number() Integer Overflow + allowing Archive Entry Injection. + + [SOAP] Fix CVE-2026-91765: Unbounded recursion in server-side + cleanup_xml_node(). + + Fix CVE-2026-91766: Cross-origin credential leak in HTTP stream wrapper + redirects. + + [OpenSSL] Fix CVE-2026-91767: Heap-buffer-overflow in + php_openssl_matches_wildcard_name() on crafted server cert wildcard CN. + + [FPM] Fix CVE-2026-91768: IPv6 ACL bypass in FastCGI + listen.allowed_clients due to partial address comparison. + + [OpenSSL] Fix CVE-2026-91769: TLS hostname verification falls back to CN + after SAN Mismatch. + + Fix CVE-2026-92842: OOB read / info leak in convert.* stream filters + when line-break-chars contains NUL. + + Fix CVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when + following a redirect with an empty Location header. + + [Filter] Fix Encode 0xFF in FILTER_SANITIZE_ENCODED. + * Refresh d/patches. + + -- Guilhem Moulin Sun, 04 Oct 2026 16:03:09 +0200 + + php8.2 (8.2.33-1~deb12u1) bookworm-security; urgency=high + + * Non-maintainer upload by the LTS Team. + * New upstream version 8.2.33: + + Fix CVE-2026-7260: Stack overflow in phar with circular symlinks. + (Closes: #1143153) + + Fix CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash + breakout. (Closes: #1143153) + + Fix leak on double DatePeriod::__construct() call. + * Refresh d/patches. + + -- Guilhem Moulin Mon, 10 Aug 2026 18:44:03 +0200 + + php8.2 (8.2.32-1~deb12u1) bookworm-security; urgency=high + + * New upstream version 8.2.32 + + [CVE-2026-14355]: Memory corruption (zend_mm_heap corrupted) in + openssl_encrypt with AES-WRAP-PAD. + + -- Ondřej Surý Fri, 03 Jul 2026 14:22:11 +0200 + + php8.2 (8.2.31-1~deb12u1) bookworm-security; urgency=high + + * New upstream version 8.2.31 + + [CVE-2026-6735]: XSS within status endpoint + + [CVE-2026-7259]: Null pointer dereference in php_mb_check_encoding() + via mb_ereg_search_init() + + [CVE-2025-14179]: SQL injection via NUL bytes in quoted strings + + [CVE-2026-6722]: Stale SOAP_GLOBAL(ref_map) pointer with Apache Map + + [CVE-2026-7261]: Use-after-free after header parsing failure with + SOAP_PERSISTENCE_SESSION + + [CVE-2026-7262]: Broken Apache map value NULL check + + [CVE-2026-7568]: Signed integer overflow of char array offset + + [CVE-2026-7258]: Consistently pass unsigned char to ctype.h functions + + -- Ondřej Surý Fri, 08 May 2026 09:20:38 +0200 + + php8.2 (8.2.30-1~deb12u1) bookworm-security; urgency=high + + * New upstream version 8.2.30 + + [CVE-2025-14180]: Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null + deref). + + [CVE-2025-14178]: Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in + array_merge()). + + [CVE-2025-14177]: Fixed GHSA-3237-qqm7-mfv7 (Information Leak of + Memory in getimagesize). + + -- Ondřej Surý Sat, 28 Feb 2026 08:07:34 +0100 + + php8.2 (8.2.29-1~deb12u1) bookworm-security; urgency=high + + * New upstream version 8.2.29 + - [CVE-2025-1735]: pgsql extension does not check for errors during + escaping. + - [CVE-2025-6491]: NULL Pointer Dereference in PHP SOAP Extension + via Large XML Namespace Prefix. + - [CVE-2025-6491]: Null byte termination in hostnames. + + -- Ondřej Surý Thu, 03 Jul 2025 18:16:05 +0200 + + php8.2 (8.2.28-1~deb12u1) bookworm-security; urgency=high + + * New upstream version 8.2.28 + - [CVE-2025-1219]: libxml streams use wrong `content-type` header + when requesting a redirected resource. + - [CVE-2025-1736]: Stream HTTP wrapper header check might omit + basic auth header. + - [CVE-2025-1861]: Stream HTTP wrapper truncate redirect location + to 1024 bytes. + - [CVE-2025-1734]: Streams HTTP wrapper does not fail for headers + without colon. + - [CVE-2025-1217]: Header parser of `http` stream wrapper does not + handle folded headers. + + -- Ondřej Surý Thu, 13 Mar 2025 19:21:38 +0100 + + php8.2 (8.2.26-1~deb12u1) bookworm-security; urgency=high + + * New upstream version 8.2.26 + + Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface. + + [CVE-2024-8929]: Leak partial content of the heap through heap buffer + over-read. + + [CVE-2024-8932]: OOB access in ldap_escape. + + [CVE-2024-11233]: Single byte overread with + convert.quoted-printable-decode filter. + + [CVE-2024-11234]: Configuring a proxy in a stream context might allow + for CRLF injection in URIs. + + [CVE-2024-11236]: Integer overflow in the dblib quoter causing OOB + writes. + + [CVE-2024-11236]: Integer overflow in the firebird quoter causing OOB + writes. + * Revert "ext/gmp: gmp_pow fix FPE with large values" upstream patch + + -- Ondřej Surý Mon, 25 Nov 2024 18:21:51 +0100 + + php8.2 (8.2.25-1~deb12u1) bookworm-security; urgency=medium + + * New upstream version 8.2.25 + + -- Ondřej Surý Wed, 30 Oct 2024 11:38:36 +0100 + + php8.2 (8.2.24-1~deb12u1) bookworm-security; urgency=high + + * New upstream version 8.2.24 + + [CVE-2024-8926]: Bypass of CVE-2024-4577, Parameter Injection + Vulnerability + + [CVE-2024-8927]: cgi.force_redirect configuration is bypassable due + to the environment variable collision + + [CVE-2024-8927]: Logs from FPM childrens may be altered + + [CVE-2024-8925]: Erroneous parsing of multipart form data + + -- Ondřej Surý Fri, 27 Sep 2024 06:16:10 +0200 + + php8.2 (8.2.23-1~deb12u1) bookworm; urgency=medium + + * New upstream version 8.2.23 (Closes: #1080055) + + -- Ondřej Surý Fri, 30 Aug 2024 11:34:15 +0200 + + php8.2 (8.2.20-1~deb12u1) bookworm-security; urgency=high + + * New upstream version 8.2.20 + + [CVE-2024-4577]: Bypass of CVE-2012-1823, Argument Injection in + PHP-CGI. + + [CVE-2024-5458]: Filter bypass in filter_var FILTER_VALIDATE_URL. + + [CVE-2024-5585]: Bypass of CVE-2024-1874. + * Fix GH-14480: Method visibility issue introduced in version 8.2.20. + + -- Ondřej Surý Mon, 17 Jun 2024 15:33:14 +0200 + + php8.2 (8.2.18-1~deb12u1) bookworm-security; urgency=high + + * New upstream version 8.2.18 + + CVE-2024-1874: Fixed bug GHSA-pc52-254m-w9w7 (Command injection via + array-ish $command parameter of proc_open). + + CVE-2024-2756: Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- + cookie bypass due to partial CVE-2022-31629 fix). + + CVE-2024-3096: Fixed bug GHSA-h746-cjrr-wfmr (password_verify can + erroneously return true, opening ATO risk). + + -- Ondřej Surý Fri, 12 Apr 2024 00:07:45 +0200 php8.2 (8.2.7-1~deb12u1) bookworm-security; urgency=high