- php8.2 (8.2.7-1~deb12u1+rpi1) bookworm-staging; urgency=medium
++php8.2 (8.2.35-1~deb12u1+rpi1) bookworm-staging; urgency=medium
+
++ [changes brought forward from 8.2.7-1~deb12u1+rpi1 by Peter Michael Green <plugwash@raspbian.org> at Thu, 20 Jul 2023 18:02:54 +0000]
+ * Fix fpu setting for raspbian.
+
- -- Peter Michael Green <plugwash@raspbian.org> Thu, 20 Jul 2023 18:02:54 +0000
++ -- Raspbian forward porter <root@raspbian.org> Thu, 22 Oct 2026 18:01:55 +0000
++
+ php8.2 (8.2.35-1~deb12u1) bookworm-security; urgency=high
+
+ * Non-maintainer upload by the LTS Team.
+ * New upstream version 8.2.35:
+ + Fix CVE-2026-109618 and CVE-2026-109619: State corruption via bailout.
+ * Refresh d/patches.
+
+ -- Guilhem Moulin <guilhem@debian.org> Wed, 21 Oct 2026 08:29:51 +0200
+
+ php8.2 (8.2.34-1~deb12u1) bookworm-security; urgency=high
+
+ * Non-maintainer upload by the LTS Team.
+ * New upstream version 8.2.34:
+ + [MySQLnd] Fix CVE-2025-1218: Various packet overreads in mysqlnd wire
+ protocol.
+ + [SOAP] Fix CVE-2025-14181: Integer overflow to buffer overflow in SOAP
+ HTTP parsing.
+ + [Phar] Fix CVE-2026-6103: Phar TAR phar_tar_number() Integer Overflow
+ allowing Archive Entry Injection.
+ + [SOAP] Fix CVE-2026-91765: Unbounded recursion in server-side
+ cleanup_xml_node().
+ + Fix CVE-2026-91766: Cross-origin credential leak in HTTP stream wrapper
+ redirects.
+ + [OpenSSL] Fix CVE-2026-91767: Heap-buffer-overflow in
+ php_openssl_matches_wildcard_name() on crafted server cert wildcard CN.
+ + [FPM] Fix CVE-2026-91768: IPv6 ACL bypass in FastCGI
+ listen.allowed_clients due to partial address comparison.
+ + [OpenSSL] Fix CVE-2026-91769: TLS hostname verification falls back to CN
+ after SAN Mismatch.
+ + Fix CVE-2026-92842: OOB read / info leak in convert.* stream filters
+ when line-break-chars contains NUL.
+ + Fix CVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when
+ following a redirect with an empty Location header.
+ + [Filter] Fix Encode 0xFF in FILTER_SANITIZE_ENCODED.
+ * Refresh d/patches.
+
+ -- Guilhem Moulin <guilhem@debian.org> Sun, 04 Oct 2026 16:03:09 +0200
+
+ php8.2 (8.2.33-1~deb12u1) bookworm-security; urgency=high
+
+ * Non-maintainer upload by the LTS Team.
+ * New upstream version 8.2.33:
+ + Fix CVE-2026-7260: Stack overflow in phar with circular symlinks.
+ (Closes: #1143153)
+ + Fix CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash
+ breakout. (Closes: #1143153)
+ + Fix leak on double DatePeriod::__construct() call.
+ * Refresh d/patches.
+
+ -- Guilhem Moulin <guilhem@debian.org> Mon, 10 Aug 2026 18:44:03 +0200
+
+ php8.2 (8.2.32-1~deb12u1) bookworm-security; urgency=high
+
+ * New upstream version 8.2.32
+ + [CVE-2026-14355]: Memory corruption (zend_mm_heap corrupted) in
+ openssl_encrypt with AES-WRAP-PAD.
+
+ -- Ondřej Surý <ondrej@debian.org> Fri, 03 Jul 2026 14:22:11 +0200
+
+ php8.2 (8.2.31-1~deb12u1) bookworm-security; urgency=high
+
+ * New upstream version 8.2.31
+ + [CVE-2026-6735]: XSS within status endpoint
+ + [CVE-2026-7259]: Null pointer dereference in php_mb_check_encoding()
+ via mb_ereg_search_init()
+ + [CVE-2025-14179]: SQL injection via NUL bytes in quoted strings
+ + [CVE-2026-6722]: Stale SOAP_GLOBAL(ref_map) pointer with Apache Map
+ + [CVE-2026-7261]: Use-after-free after header parsing failure with
+ SOAP_PERSISTENCE_SESSION
+ + [CVE-2026-7262]: Broken Apache map value NULL check
+ + [CVE-2026-7568]: Signed integer overflow of char array offset
+ + [CVE-2026-7258]: Consistently pass unsigned char to ctype.h functions
+
+ -- Ondřej Surý <ondrej@debian.org> Fri, 08 May 2026 09:20:38 +0200
+
+ php8.2 (8.2.30-1~deb12u1) bookworm-security; urgency=high
+
+ * New upstream version 8.2.30
+ + [CVE-2025-14180]: Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null
+ deref).
+ + [CVE-2025-14178]: Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in
+ array_merge()).
+ + [CVE-2025-14177]: Fixed GHSA-3237-qqm7-mfv7 (Information Leak of
+ Memory in getimagesize).
+
+ -- Ondřej Surý <ondrej@debian.org> Sat, 28 Feb 2026 08:07:34 +0100
+
+ php8.2 (8.2.29-1~deb12u1) bookworm-security; urgency=high
+
+ * New upstream version 8.2.29
+ - [CVE-2025-1735]: pgsql extension does not check for errors during
+ escaping.
+ - [CVE-2025-6491]: NULL Pointer Dereference in PHP SOAP Extension
+ via Large XML Namespace Prefix.
+ - [CVE-2025-6491]: Null byte termination in hostnames.
+
+ -- Ondřej Surý <ondrej@debian.org> Thu, 03 Jul 2025 18:16:05 +0200
+
+ php8.2 (8.2.28-1~deb12u1) bookworm-security; urgency=high
+
+ * New upstream version 8.2.28
+ - [CVE-2025-1219]: libxml streams use wrong `content-type` header
+ when requesting a redirected resource.
+ - [CVE-2025-1736]: Stream HTTP wrapper header check might omit
+ basic auth header.
+ - [CVE-2025-1861]: Stream HTTP wrapper truncate redirect location
+ to 1024 bytes.
+ - [CVE-2025-1734]: Streams HTTP wrapper does not fail for headers
+ without colon.
+ - [CVE-2025-1217]: Header parser of `http` stream wrapper does not
+ handle folded headers.
+
+ -- Ondřej Surý <ondrej@debian.org> Thu, 13 Mar 2025 19:21:38 +0100
+
+ php8.2 (8.2.26-1~deb12u1) bookworm-security; urgency=high
+
+ * New upstream version 8.2.26
+ + Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface.
+ + [CVE-2024-8929]: Leak partial content of the heap through heap buffer
+ over-read.
+ + [CVE-2024-8932]: OOB access in ldap_escape.
+ + [CVE-2024-11233]: Single byte overread with
+ convert.quoted-printable-decode filter.
+ + [CVE-2024-11234]: Configuring a proxy in a stream context might allow
+ for CRLF injection in URIs.
+ + [CVE-2024-11236]: Integer overflow in the dblib quoter causing OOB
+ writes.
+ + [CVE-2024-11236]: Integer overflow in the firebird quoter causing OOB
+ writes.
+ * Revert "ext/gmp: gmp_pow fix FPE with large values" upstream patch
+
+ -- Ondřej Surý <ondrej@debian.org> Mon, 25 Nov 2024 18:21:51 +0100
+
+ php8.2 (8.2.25-1~deb12u1) bookworm-security; urgency=medium
+
+ * New upstream version 8.2.25
+
+ -- Ondřej Surý <ondrej@debian.org> Wed, 30 Oct 2024 11:38:36 +0100
+
+ php8.2 (8.2.24-1~deb12u1) bookworm-security; urgency=high
+
+ * New upstream version 8.2.24
+ + [CVE-2024-8926]: Bypass of CVE-2024-4577, Parameter Injection
+ Vulnerability
+ + [CVE-2024-8927]: cgi.force_redirect configuration is bypassable due
+ to the environment variable collision
+ + [CVE-2024-8927]: Logs from FPM childrens may be altered
+ + [CVE-2024-8925]: Erroneous parsing of multipart form data
+
+ -- Ondřej Surý <ondrej@debian.org> Fri, 27 Sep 2024 06:16:10 +0200
+
+ php8.2 (8.2.23-1~deb12u1) bookworm; urgency=medium
+
+ * New upstream version 8.2.23 (Closes: #1080055)
+
+ -- Ondřej Surý <ondrej@debian.org> Fri, 30 Aug 2024 11:34:15 +0200
+
+ php8.2 (8.2.20-1~deb12u1) bookworm-security; urgency=high
+
+ * New upstream version 8.2.20
+ + [CVE-2024-4577]: Bypass of CVE-2012-1823, Argument Injection in
+ PHP-CGI.
+ + [CVE-2024-5458]: Filter bypass in filter_var FILTER_VALIDATE_URL.
+ + [CVE-2024-5585]: Bypass of CVE-2024-1874.
+ * Fix GH-14480: Method visibility issue introduced in version 8.2.20.
+
+ -- Ondřej Surý <ondrej@debian.org> Mon, 17 Jun 2024 15:33:14 +0200
+
+ php8.2 (8.2.18-1~deb12u1) bookworm-security; urgency=high
+
+ * New upstream version 8.2.18
+ + CVE-2024-1874: Fixed bug GHSA-pc52-254m-w9w7 (Command injection via
+ array-ish $command parameter of proc_open).
+ + CVE-2024-2756: Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure-
+ cookie bypass due to partial CVE-2022-31629 fix).
+ + CVE-2024-3096: Fixed bug GHSA-h746-cjrr-wfmr (password_verify can
+ erroneously return true, opening ATO risk).
+
+ -- Ondřej Surý <ondrej@debian.org> Fri, 12 Apr 2024 00:07:45 +0200
php8.2 (8.2.7-1~deb12u1) bookworm-security; urgency=high
projects / php8.2.git / commitdiff