UnratedFix available
Security update for php8
Type: advisorySources: OSV
This update for php8 fixes the following issues: - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser (bsc#1282981). - CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing (bsc#1283216). - CVE-2026-6103: Archive entry injection via integer overflow in TAR parser (bsc#1282980). - CVE-2026-91765: Denial of Service via unbounded recursion in SOAP parser (bsc#1282875). - CVE-2026-91766: Credential disclosure via cross-origin HTTP redirects (bsc#1282876). - CVE-2026-91767: Information disclosure via crafted TLS server certificate (bsc#1282877). - CVE-2026-91768: Access control bypass via partial IPv6 address comparison (bsc#1282878). - CVE-2026-91769: OpenSSL stream peer verification falls back to the Common Name whenever no `subjectAltName` matches, allowing trusted certificate impersonation (bsc#1283044). - CVE-2026-92842: Information disclosure via out-of-bounds read in stream filters (bsc#1282985). - CVE-2026-93682: Out-of-bounds read via empty HTTP redirect Location header (bsc#1282986). Changes for php8: - Updated to version 8.3.35
- Products
- apache2-mod_php8, php8, php8-embed, php8-fastcgi, php8-fpm, php8-test
- Affected versions
- Not specified
- Fixed versions
- 8.3.35-150700.3.21.1
- CVEs
- CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 13:03 UTC · Revision 1
Source evidence
This update for php8 fixes the following issues: - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser (bsc#1282981). - CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing (bsc#1283216). - CVE-2026-6103: Archive entry injection via integer overflow in TAR parser (bsc#1282980). - CVE-2026-91765: Denial of Service via unbounded recursion in SOAP parser (bsc#1282875). - CVE-2026-91766: Credential disclosure via cross-origin HTTP redirects (bsc#1282876). - CVE-2026-91767: Information disclosure via crafted TLS server certificate (bsc#1282877). - CVE-2026-91768: Access control bypass via partial IPv6 address comparison (bsc#1282878). - CVE-2026-91769: OpenSSL stream peer verification falls back to the Common Name whenever no `subjectAltName` matches, allowing trusted certificate impersonation (bsc#1283044). - CVE-2026-92842: Information disclosure via out-of-bounds read in stream filters (bsc#1282985). - CVE-2026-93682: Out-of-bounds read via empty HTTP redirect Location header (bsc#1282986). Changes for php8: - Updated to version 8.3.35
osv:SUSE-SU-2026:4602-1
apache2-mod_php8
Fixed versions: 8.3.35-150700.3.21.1
php8
Fixed versions: 8.3.35-150700.3.21.1
php8-embed
Fixed versions: 8.3.35-150700.3.21.1
php8-fastcgi
Fixed versions: 8.3.35-150700.3.21.1
php8-fpm
Fixed versions: 8.3.35-150700.3.21.1
php8-test
Fixed versions: 8.3.35-150700.3.21.1
Complete source record
{
"id": "4c80e87ffd54d14a34223cdeb0e1f0d33ec46193011e72396820ee18f6a6b5a8",
"url": "https://osv.dev/vulnerability/SUSE-SU-2026%3A4602-1",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Security update for php8",
"summary": "This update for php8 fixes the following issues: - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser (bsc#1282981). - CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing (bsc#1283216). - CVE-2026-6103: Archive entry injection via integer overflow in TAR parser (bsc#1282980). - CVE-2026-91765: Denial of Service via unbounded recursion in SOAP parser (bsc#1282875). - CVE-2026-91766: Credential disclosure via cross-origin HTTP redirects (bsc#1282876). - CVE-2026-91767: Information disclosure via crafted TLS server certificate (bsc#1282877). - CVE-2026-91768: Access control bypass via partial IPv6 address comparison (bsc#1282878). - CVE-2026-91769: OpenSSL stream peer verification falls back to the Common Name whenever no `subjectAltName` matches, allowing trusted certificate impersonation (bsc#1283044). - CVE-2026-92842: Information disclosure via out-of-bounds read in stream filters (bsc#1282985). - CVE-2026-93682: Out-of-bounds read via empty HTTP redirect Location header (bsc#1282986). Changes for php8: - Updated to version 8.3.35",
"evidence": "osv:SUSE-SU-2026:4602-1",
"products": [
{
"name": {
"value": "apache2-mod_php8",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.3.35-150700.3.21.1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "php8",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.3.35-150700.3.21.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "php8-embed",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.3.35-150700.3.21.1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "php8-fastcgi",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.3.35-150700.3.21.1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "php8-fpm",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.3.35-150700.3.21.1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "php8-test",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.3.35-150700.3.21.1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "SUSE-SU-2026:4602-1",
"aliases": [
"SUSE-SU-2026:4602-1"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.35-150700.3.21.1"
}
]
}
],
"package": {
"name": "apache2-mod_php8",
"purl": "pkg:rpm/suse/apache2-mod_php8&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7",
"ecosystem": "SUSE:Linux Enterprise Module for Web and Scripting 15 SP7"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4602-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"php8": "8.3.35-150700.3.21.1",
"php8-gd": "8.3.35-150700.3.21.1",
"php8-bz2": "8.3.35-150700.3.21.1",
"php8-cli": "8.3.35-150700.3.21.1",
"php8-dba": "8.3.35-150700.3.21.1",
"php8-dom": "8.3.35-150700.3.21.1",
"php8-fpm": "8.3.35-150700.3.21.1",
"php8-ftp": "8.3.35-150700.3.21.1",
"php8-gmp": "8.3.35-150700.3.21.1",
"php8-pdo": "8.3.35-150700.3.21.1",
"php8-xsl": "8.3.35-150700.3.21.1",
"php8-zip": "8.3.35-150700.3.21.1",
"php8-curl": "8.3.35-150700.3.21.1",
"php8-exif": "8.3.35-150700.3.21.1",
"php8-intl": "8.3.35-150700.3.21.1",
"php8-ldap": "8.3.35-150700.3.21.1",
"php8-odbc": "8.3.35-150700.3.21.1",
"php8-phar": "8.3.35-150700.3.21.1",
"php8-snmp": "8.3.35-150700.3.21.1",
"php8-soap": "8.3.35-150700.3.21.1",
"php8-test": "8.3.35-150700.3.21.1",
"php8-tidy": "8.3.35-150700.3.21.1",
"php8-zlib": "8.3.35-150700.3.21.1",
"php8-ctype": "8.3.35-150700.3.21.1",
"php8-devel": "8.3.35-150700.3.21.1",
"php8-embed": "8.3.35-150700.3.21.1",
"php8-iconv": "8.3.35-150700.3.21.1",
"php8-mysql": "8.3.35-150700.3.21.1",
"php8-pcntl": "8.3.35-150700.3.21.1",
"php8-pgsql": "8.3.35-150700.3.21.1",
"php8-posix": "8.3.35-150700.3.21.1",
"php8-shmop": "8.3.35-150700.3.21.1",
"php8-bcmath": "8.3.35-150700.3.21.1",
"php8-sodium": "8.3.35-150700.3.21.1",
"php8-sqlite": "8.3.35-150700.3.21.1",
"php8-enchant": "8.3.35-150700.3.21.1",
"php8-fastcgi": "8.3.35-150700.3.21.1",
"php8-gettext": "8.3.35-150700.3.21.1",
"php8-opcache": "8.3.35-150700.3.21.1",
"php8-openssl": "8.3.35-150700.3.21.1",
"php8-sockets": "8.3.35-150700.3.21.1",
"php8-sysvmsg": "8.3.35-150700.3.21.1",
"php8-sysvsem": "8.3.35-150700.3.21.1",
"php8-sysvshm": "8.3.35-150700.3.21.1",
"php8-calendar": "8.3.35-150700.3.21.1",
"php8-fileinfo": "8.3.35-150700.3.21.1",
"php8-mbstring": "8.3.35-150700.3.21.1",
"php8-readline": "8.3.35-150700.3.21.1",
"php8-tokenizer": "8.3.35-150700.3.21.1",
"php8-xmlreader": "8.3.35-150700.3.21.1",
"php8-xmlwriter": "8.3.35-150700.3.21.1",
"apache2-mod_php8": "8.3.35-150700.3.21.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.35-150700.3.21.1"
}
]
}
],
"package": {
"name": "php8",
"purl": "pkg:rpm/suse/php8&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7",
"ecosystem": "SUSE:Linux Enterprise Module for Web and Scripting 15 SP7"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4602-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"php8": "8.3.35-150700.3.21.1",
"php8-gd": "8.3.35-150700.3.21.1",
"php8-bz2": "8.3.35-150700.3.21.1",
"php8-cli": "8.3.35-150700.3.21.1",
"php8-dba": "8.3.35-150700.3.21.1",
"php8-dom": "8.3.35-150700.3.21.1",
"php8-fpm": "8.3.35-150700.3.21.1",
"php8-ftp": "8.3.35-150700.3.21.1",
"php8-gmp": "8.3.35-150700.3.21.1",
"php8-pdo": "8.3.35-150700.3.21.1",
"php8-xsl": "8.3.35-150700.3.21.1",
"php8-zip": "8.3.35-150700.3.21.1",
"php8-curl": "8.3.35-150700.3.21.1",
"php8-exif": "8.3.35-150700.3.21.1",
"php8-intl": "8.3.35-150700.3.21.1",
"php8-ldap": "8.3.35-150700.3.21.1",
"php8-odbc": "8.3.35-150700.3.21.1",
"php8-phar": "8.3.35-150700.3.21.1",
"php8-snmp": "8.3.35-150700.3.21.1",
"php8-soap": "8.3.35-150700.3.21.1",
"php8-test": "8.3.35-150700.3.21.1",
"php8-tidy": "8.3.35-150700.3.21.1",
"php8-zlib": "8.3.35-150700.3.21.1",
"php8-ctype": "8.3.35-150700.3.21.1",
"php8-devel": "8.3.35-150700.3.21.1",
"php8-embed": "8.3.35-150700.3.21.1",
"php8-iconv": "8.3.35-150700.3.21.1",
"php8-mysql": "8.3.35-150700.3.21.1",
"php8-pcntl": "8.3.35-150700.3.21.1",
"php8-pgsql": "8.3.35-150700.3.21.1",
"php8-posix": "8.3.35-150700.3.21.1",
"php8-shmop": "8.3.35-150700.3.21.1",
"php8-bcmath": "8.3.35-150700.3.21.1",
"php8-sodium": "8.3.35-150700.3.21.1",
"php8-sqlite": "8.3.35-150700.3.21.1",
"php8-enchant": "8.3.35-150700.3.21.1",
"php8-fastcgi": "8.3.35-150700.3.21.1",
"php8-gettext": "8.3.35-150700.3.21.1",
"php8-opcache": "8.3.35-150700.3.21.1",
"php8-openssl": "8.3.35-150700.3.21.1",
"php8-sockets": "8.3.35-150700.3.21.1",
"php8-sysvmsg": "8.3.35-150700.3.21.1",
"php8-sysvsem": "8.3.35-150700.3.21.1",
"php8-sysvshm": "8.3.35-150700.3.21.1",
"php8-calendar": "8.3.35-150700.3.21.1",
"php8-fileinfo": "8.3.35-150700.3.21.1",
"php8-mbstring": "8.3.35-150700.3.21.1",
"php8-readline": "8.3.35-150700.3.21.1",
"php8-tokenizer": "8.3.35-150700.3.21.1",
"php8-xmlreader": "8.3.35-150700.3.21.1",
"php8-xmlwriter": "8.3.35-150700.3.21.1",
"apache2-mod_php8": "8.3.35-150700.3.21.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.35-150700.3.21.1"
}
]
}
],
"package": {
"name": "php8-embed",
"purl": "pkg:rpm/suse/php8-embed&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7",
"ecosystem": "SUSE:Linux Enterprise Module for Web and Scripting 15 SP7"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4602-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"php8": "8.3.35-150700.3.21.1",
"php8-gd": "8.3.35-150700.3.21.1",
"php8-bz2": "8.3.35-150700.3.21.1",
"php8-cli": "8.3.35-150700.3.21.1",
"php8-dba": "8.3.35-150700.3.21.1",
"php8-dom": "8.3.35-150700.3.21.1",
"php8-fpm": "8.3.35-150700.3.21.1",
"php8-ftp": "8.3.35-150700.3.21.1",
"php8-gmp": "8.3.35-150700.3.21.1",
"php8-pdo": "8.3.35-150700.3.21.1",
"php8-xsl": "8.3.35-150700.3.21.1",
"php8-zip": "8.3.35-150700.3.21.1",
"php8-curl": "8.3.35-150700.3.21.1",
"php8-exif": "8.3.35-150700.3.21.1",
"php8-intl": "8.3.35-150700.3.21.1",
"php8-ldap": "8.3.35-150700.3.21.1",
"php8-odbc": "8.3.35-150700.3.21.1",
"php8-phar": "8.3.35-150700.3.21.1",
"php8-snmp": "8.3.35-150700.3.21.1",
"php8-soap": "8.3.35-150700.3.21.1",
"php8-test": "8.3.35-150700.3.21.1",
"php8-tidy": "8.3.35-150700.3.21.1",
"php8-zlib": "8.3.35-150700.3.21.1",
"php8-ctype": "8.3.35-150700.3.21.1",
"php8-devel": "8.3.35-150700.3.21.1",
"php8-embed": "8.3.35-150700.3.21.1",
"php8-iconv": "8.3.35-150700.3.21.1",
"php8-mysql": "8.3.35-150700.3.21.1",
"php8-pcntl": "8.3.35-150700.3.21.1",
"php8-pgsql": "8.3.35-150700.3.21.1",
"php8-posix": "8.3.35-150700.3.21.1",
"php8-shmop": "8.3.35-150700.3.21.1",
"php8-bcmath": "8.3.35-150700.3.21.1",
"php8-sodium": "8.3.35-150700.3.21.1",
"php8-sqlite": "8.3.35-150700.3.21.1",
"php8-enchant": "8.3.35-150700.3.21.1",
"php8-fastcgi": "8.3.35-150700.3.21.1",
"php8-gettext": "8.3.35-150700.3.21.1",
"php8-opcache": "8.3.35-150700.3.21.1",
"php8-openssl": "8.3.35-150700.3.21.1",
"php8-sockets": "8.3.35-150700.3.21.1",
"php8-sysvmsg": "8.3.35-150700.3.21.1",
"php8-sysvsem": "8.3.35-150700.3.21.1",
"php8-sysvshm": "8.3.35-150700.3.21.1",
"php8-calendar": "8.3.35-150700.3.21.1",
"php8-fileinfo": "8.3.35-150700.3.21.1",
"php8-mbstring": "8.3.35-150700.3.21.1",
"php8-readline": "8.3.35-150700.3.21.1",
"php8-tokenizer": "8.3.35-150700.3.21.1",
"php8-xmlreader": "8.3.35-150700.3.21.1",
"php8-xmlwriter": "8.3.35-150700.3.21.1",
"apache2-mod_php8": "8.3.35-150700.3.21.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.35-150700.3.21.1"
}
]
}
],
"package": {
"name": "php8-fastcgi",
"purl": "pkg:rpm/suse/php8-fastcgi&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7",
"ecosystem": "SUSE:Linux Enterprise Module for Web and Scripting 15 SP7"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4602-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"php8": "8.3.35-150700.3.21.1",
"php8-gd": "8.3.35-150700.3.21.1",
"php8-bz2": "8.3.35-150700.3.21.1",
"php8-cli": "8.3.35-150700.3.21.1",
"php8-dba": "8.3.35-150700.3.21.1",
"php8-dom": "8.3.35-150700.3.21.1",
"php8-fpm": "8.3.35-150700.3.21.1",
"php8-ftp": "8.3.35-150700.3.21.1",
"php8-gmp": "8.3.35-150700.3.21.1",
"php8-pdo": "8.3.35-150700.3.21.1",
"php8-xsl": "8.3.35-150700.3.21.1",
"php8-zip": "8.3.35-150700.3.21.1",
"php8-curl": "8.3.35-150700.3.21.1",
"php8-exif": "8.3.35-150700.3.21.1",
"php8-intl": "8.3.35-150700.3.21.1",
"php8-ldap": "8.3.35-150700.3.21.1",
"php8-odbc": "8.3.35-150700.3.21.1",
"php8-phar": "8.3.35-150700.3.21.1",
"php8-snmp": "8.3.35-150700.3.21.1",
"php8-soap": "8.3.35-150700.3.21.1",
"php8-test": "8.3.35-150700.3.21.1",
"php8-tidy": "8.3.35-150700.3.21.1",
"php8-zlib": "8.3.35-150700.3.21.1",
"php8-ctype": "8.3.35-150700.3.21.1",
"php8-devel": "8.3.35-150700.3.21.1",
"php8-embed": "8.3.35-150700.3.21.1",
"php8-iconv": "8.3.35-150700.3.21.1",
"php8-mysql": "8.3.35-150700.3.21.1",
"php8-pcntl": "8.3.35-150700.3.21.1",
"php8-pgsql": "8.3.35-150700.3.21.1",
"php8-posix": "8.3.35-150700.3.21.1",
"php8-shmop": "8.3.35-150700.3.21.1",
"php8-bcmath": "8.3.35-150700.3.21.1",
"php8-sodium": "8.3.35-150700.3.21.1",
"php8-sqlite": "8.3.35-150700.3.21.1",
"php8-enchant": "8.3.35-150700.3.21.1",
"php8-fastcgi": "8.3.35-150700.3.21.1",
"php8-gettext": "8.3.35-150700.3.21.1",
"php8-opcache": "8.3.35-150700.3.21.1",
"php8-openssl": "8.3.35-150700.3.21.1",
"php8-sockets": "8.3.35-150700.3.21.1",
"php8-sysvmsg": "8.3.35-150700.3.21.1",
"php8-sysvsem": "8.3.35-150700.3.21.1",
"php8-sysvshm": "8.3.35-150700.3.21.1",
"php8-calendar": "8.3.35-150700.3.21.1",
"php8-fileinfo": "8.3.35-150700.3.21.1",
"php8-mbstring": "8.3.35-150700.3.21.1",
"php8-readline": "8.3.35-150700.3.21.1",
"php8-tokenizer": "8.3.35-150700.3.21.1",
"php8-xmlreader": "8.3.35-150700.3.21.1",
"php8-xmlwriter": "8.3.35-150700.3.21.1",
"apache2-mod_php8": "8.3.35-150700.3.21.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.35-150700.3.21.1"
}
]
}
],
"package": {
"name": "php8-fpm",
"purl": "pkg:rpm/suse/php8-fpm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7",
"ecosystem": "SUSE:Linux Enterprise Module for Web and Scripting 15 SP7"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4602-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"php8": "8.3.35-150700.3.21.1",
"php8-gd": "8.3.35-150700.3.21.1",
"php8-bz2": "8.3.35-150700.3.21.1",
"php8-cli": "8.3.35-150700.3.21.1",
"php8-dba": "8.3.35-150700.3.21.1",
"php8-dom": "8.3.35-150700.3.21.1",
"php8-fpm": "8.3.35-150700.3.21.1",
"php8-ftp": "8.3.35-150700.3.21.1",
"php8-gmp": "8.3.35-150700.3.21.1",
"php8-pdo": "8.3.35-150700.3.21.1",
"php8-xsl": "8.3.35-150700.3.21.1",
"php8-zip": "8.3.35-150700.3.21.1",
"php8-curl": "8.3.35-150700.3.21.1",
"php8-exif": "8.3.35-150700.3.21.1",
"php8-intl": "8.3.35-150700.3.21.1",
"php8-ldap": "8.3.35-150700.3.21.1",
"php8-odbc": "8.3.35-150700.3.21.1",
"php8-phar": "8.3.35-150700.3.21.1",
"php8-snmp": "8.3.35-150700.3.21.1",
"php8-soap": "8.3.35-150700.3.21.1",
"php8-test": "8.3.35-150700.3.21.1",
"php8-tidy": "8.3.35-150700.3.21.1",
"php8-zlib": "8.3.35-150700.3.21.1",
"php8-ctype": "8.3.35-150700.3.21.1",
"php8-devel": "8.3.35-150700.3.21.1",
"php8-embed": "8.3.35-150700.3.21.1",
"php8-iconv": "8.3.35-150700.3.21.1",
"php8-mysql": "8.3.35-150700.3.21.1",
"php8-pcntl": "8.3.35-150700.3.21.1",
"php8-pgsql": "8.3.35-150700.3.21.1",
"php8-posix": "8.3.35-150700.3.21.1",
"php8-shmop": "8.3.35-150700.3.21.1",
"php8-bcmath": "8.3.35-150700.3.21.1",
"php8-sodium": "8.3.35-150700.3.21.1",
"php8-sqlite": "8.3.35-150700.3.21.1",
"php8-enchant": "8.3.35-150700.3.21.1",
"php8-fastcgi": "8.3.35-150700.3.21.1",
"php8-gettext": "8.3.35-150700.3.21.1",
"php8-opcache": "8.3.35-150700.3.21.1",
"php8-openssl": "8.3.35-150700.3.21.1",
"php8-sockets": "8.3.35-150700.3.21.1",
"php8-sysvmsg": "8.3.35-150700.3.21.1",
"php8-sysvsem": "8.3.35-150700.3.21.1",
"php8-sysvshm": "8.3.35-150700.3.21.1",
"php8-calendar": "8.3.35-150700.3.21.1",
"php8-fileinfo": "8.3.35-150700.3.21.1",
"php8-mbstring": "8.3.35-150700.3.21.1",
"php8-readline": "8.3.35-150700.3.21.1",
"php8-tokenizer": "8.3.35-150700.3.21.1",
"php8-xmlreader": "8.3.35-150700.3.21.1",
"php8-xmlwriter": "8.3.35-150700.3.21.1",
"apache2-mod_php8": "8.3.35-150700.3.21.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.35-150700.3.21.1"
}
]
}
],
"package": {
"name": "php8-test",
"purl": "pkg:rpm/suse/php8-test&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7",
"ecosystem": "SUSE:Linux Enterprise Module for Web and Scripting 15 SP7"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4602-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"php8": "8.3.35-150700.3.21.1",
"php8-gd": "8.3.35-150700.3.21.1",
"php8-bz2": "8.3.35-150700.3.21.1",
"php8-cli": "8.3.35-150700.3.21.1",
"php8-dba": "8.3.35-150700.3.21.1",
"php8-dom": "8.3.35-150700.3.21.1",
"php8-fpm": "8.3.35-150700.3.21.1",
"php8-ftp": "8.3.35-150700.3.21.1",
"php8-gmp": "8.3.35-150700.3.21.1",
"php8-pdo": "8.3.35-150700.3.21.1",
"php8-xsl": "8.3.35-150700.3.21.1",
"php8-zip": "8.3.35-150700.3.21.1",
"php8-curl": "8.3.35-150700.3.21.1",
"php8-exif": "8.3.35-150700.3.21.1",
"php8-intl": "8.3.35-150700.3.21.1",
"php8-ldap": "8.3.35-150700.3.21.1",
"php8-odbc": "8.3.35-150700.3.21.1",
"php8-phar": "8.3.35-150700.3.21.1",
"php8-snmp": "8.3.35-150700.3.21.1",
"php8-soap": "8.3.35-150700.3.21.1",
"php8-test": "8.3.35-150700.3.21.1",
"php8-tidy": "8.3.35-150700.3.21.1",
"php8-zlib": "8.3.35-150700.3.21.1",
"php8-ctype": "8.3.35-150700.3.21.1",
"php8-devel": "8.3.35-150700.3.21.1",
"php8-embed": "8.3.35-150700.3.21.1",
"php8-iconv": "8.3.35-150700.3.21.1",
"php8-mysql": "8.3.35-150700.3.21.1",
"php8-pcntl": "8.3.35-150700.3.21.1",
"php8-pgsql": "8.3.35-150700.3.21.1",
"php8-posix": "8.3.35-150700.3.21.1",
"php8-shmop": "8.3.35-150700.3.21.1",
"php8-bcmath": "8.3.35-150700.3.21.1",
"php8-sodium": "8.3.35-150700.3.21.1",
"php8-sqlite": "8.3.35-150700.3.21.1",
"php8-enchant": "8.3.35-150700.3.21.1",
"php8-fastcgi": "8.3.35-150700.3.21.1",
"php8-gettext": "8.3.35-150700.3.21.1",
"php8-opcache": "8.3.35-150700.3.21.1",
"php8-openssl": "8.3.35-150700.3.21.1",
"php8-sockets": "8.3.35-150700.3.21.1",
"php8-sysvmsg": "8.3.35-150700.3.21.1",
"php8-sysvsem": "8.3.35-150700.3.21.1",
"php8-sysvshm": "8.3.35-150700.3.21.1",
"php8-calendar": "8.3.35-150700.3.21.1",
"php8-fileinfo": "8.3.35-150700.3.21.1",
"php8-mbstring": "8.3.35-150700.3.21.1",
"php8-readline": "8.3.35-150700.3.21.1",
"php8-tokenizer": "8.3.35-150700.3.21.1",
"php8-xmlreader": "8.3.35-150700.3.21.1",
"php8-xmlwriter": "8.3.35-150700.3.21.1",
"apache2-mod_php8": "8.3.35-150700.3.21.1"
}
]
}
}
],
"modified": "2026-10-09T18:15:04.415779021Z",
"provider": "osv",
"upstream": [
"CVE-2025-1218",
"CVE-2025-14181",
"CVE-2026-6103",
"CVE-2026-91765",
"CVE-2026-91766",
"CVE-2026-91767",
"CVE-2026-91768",
"CVE-2026-91769",
"CVE-2026-92842",
"CVE-2026-93682"
],
"references": [
"https://www.suse.com/support/update/announcement/2026/suse-su-20264602-1/",
"https://bugzilla.suse.com/1282875",
"https://bugzilla.suse.com/1282876",
"https://bugzilla.suse.com/1282877",
"https://bugzilla.suse.com/1282878",
"https://bugzilla.suse.com/1282980",
"https://bugzilla.suse.com/1282981",
"https://bugzilla.suse.com/1282985",
"https://bugzilla.suse.com/1282986",
"https://bugzilla.suse.com/1283044",
"https://bugzilla.suse.com/1283216",
"https://www.suse.com/security/cve/CVE-2025-1218",
"https://www.suse.com/security/cve/CVE-2025-14181",
"https://www.suse.com/security/cve/CVE-2026-6103",
"https://www.suse.com/security/cve/CVE-2026-91765",
"https://www.suse.com/security/cve/CVE-2026-91766",
"https://www.suse.com/security/cve/CVE-2026-91767",
"https://www.suse.com/security/cve/CVE-2026-91768",
"https://www.suse.com/security/cve/CVE-2026-91769",
"https://www.suse.com/security/cve/CVE-2026-92842",
"https://www.suse.com/security/cve/CVE-2026-93682"
]
},
"related_cves": [
{
"value": "CVE-2025-1218",
"evidence": "/upstream"
},
{
"value": "CVE-2025-14181",
"evidence": "/upstream"
},
{
"value": "CVE-2026-6103",
"evidence": "/upstream"
},
{
"value": "CVE-2026-91765",
"evidence": "/upstream"
},
{
"value": "CVE-2026-91766",
"evidence": "/upstream"
},
{
"value": "CVE-2026-91767",
"evidence": "/upstream"
},
{
"value": "CVE-2026-91768",
"evidence": "/upstream"
},
{
"value": "CVE-2026-91769",
"evidence": "/upstream"
},
{
"value": "CVE-2026-92842",
"evidence": "/upstream"
},
{
"value": "CVE-2026-93682",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 124077,
"published_at": "2026-10-09T09:58:23+00:00"
}