Updated php package fixes security vulnerabilities
FILTER_SANITIZE_ENCODED does not encode 0xFF IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison Various packet overreads in mysqlnd wire protocol TLS hostname verification falls back to CN after SAN mismatch Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN Integer overflow in phar_tar_number() allowing TAR archive entry injection Unbounded recursion in server-side cleanup_xml_node() Integer overflow to buffer overflow in SOAP HTTP parsing) Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL ross-origin credential leak in HTTP stream wrapper redirects Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
MGASA-2026-0458
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MGASA-2026-0458
php
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 8.2.34-1.mga9
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.34-1.mga9"
}
]
}
],
"package": {
"name": "php",
"purl": "pkg:rpm/mageia/php?arch=source&distro=mageia-9",
"ecosystem": "Mageia:9"
},
"database_specific": {
"source": "https://advisories.mageia.org/MGASA-2026-0458.json"
},
"ecosystem_specific": {
"section": "core"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #23439 · Revision 1
- Added to Heist Feed
- Publisher date