{"schemaVersion":3,"id":"SUSE-SU-2025:1012-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for php8\n\nThis update for php8 fixes the following issues:\n\n- CVE-2025-1217: Fixed header parser of `http` stream wrapper not handling folded headers (bsc#1239664)\n- CVE-2024-11235: Fixed reference counting in php_request_shutdown causing Use-After-Free (bsc#1239666)\n- CVE-2025-1219: Fixed libxml streams using wrong `content-type` header when requesting a redirected resource (bsc#1239667)\n- CVE-2025-1734: Fixed streams HTTP wrapper not failing for headers with invalid name and no colon (bsc#1239668)\n- CVE-2025-1861: Fixed stream HTTP wrapper truncate redirect location to 1024 bytes (bsc#1239669)\n- CVE-2025-1736: Fixed stream HTTP wrapper header check might omitting basic auth header (bsc#1239670)\n\nVersion update to 8.2.28:\n    Core:\n        Fixed bug GH-17211 (observer segfault on function loaded with dl()).\n    LibXML:\n        Fixed GHSA-wg4p-4hqh-c3g9.\n        Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource).\n    Streams:\n        Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header).\n        Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes).\n        Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon).\n        Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers).\n\nVersion update version 8.2.27\n    Calendar:\n        Fixed jdtogregorian overflow.\n        Fixed cal_to_jd julian_days argument overflow.\n    COM:\n        Fixed bug GH-16991 (Getting typeinfo of non DISPATCH variant segfaults).\n    Core:\n        Fail early in *nix configuration build script.\n        Fixed bug GH-16727 (Opcache bad signal 139 crash in ZTS bookworm (frankenphp)).\n        Fixed bug GH-16799 (Assertion failure at Zend/zend_vm_execute.h:7469).\n        Fixed bug GH-16630 (UAF in lexer with encoding translation and heredocs).\n        Fix is_zend_ptr() huge block comparison.\n        Fixed potential OOB read in zend_dirname() on Windows.\n    Curl:\n        Fix various memory leaks in curl mime handling.\n    FPM:\n        Fixed GH-16432 (PHP-FPM 8.2 SIGSEGV in fpm_get_status).\n    GD:\n        Fixed GH-16776 (imagecreatefromstring overflow).\n    GMP:\n        Revert gmp_pow() overly restrictive overflow checks.\n    Hash:\n        Fixed GH-16711: Segfault in mhash().\n    Opcache:\n        Fixed bug GH-16770 (Tracing JIT type mismatch when returning UNDEF).\n        Fixed bug GH-16851 (JIT_G(enabled) not set correctly on other threads).\n        Fixed bug GH-16902 (Set of opcache tests fail zts+aarch64).\n    OpenSSL:\n        Prevent unexpected array entry conversion when reading key.\n        Fix various memory leaks related to openssl exports.\n        Fix memory leak in php_openssl_pkey_from_zval().\n    PDO:\n        Fixed memory leak of `setFetchMode()`.\n    Phar:\n        Fixed bug GH-16695 (phar:// tar parser and zero-length file header blocks).\n    PHPDBG:\n        Fixed bug GH-15208 (Segfault with breakpoint map and phpdbg_clear()).\n    SAPI:\n        Fixed bug GH-16998 (UBSAN warning in rfc1867).\n    SimpleXML:\n        Fixed bug GH-16808 (Segmentation fault in RecursiveIteratorIterator ->current() with a xml element input).\n    SNMP:\n        Fixed bug GH-16959 (snmget modifies the object_id array).\n    Standard:\n        Fixed bug GH-16905 (Internal iterator functions can't handle UNDEF properties).\n    Streams:\n        Fixed network connect poll interuption handling.","dates":{"published":"2025-03-25T12:47:30.000Z","modified":"2025-05-02T04:36:15.718Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"apache2-mod_php8&distro=openSUSE Leap 15.6","name":"apache2-mod_php8","label":"apache2-mod_php8&distro=openSUSE Leap 15.6","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/apache2-mod_php8&distro=openSUSE Leap 15.6","purlType":"rpm","versions":[{"text":"< 8.2.28-150600.3.16.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.28-150600.3.16.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"php8-embed&distro=openSUSE Leap 15.6","name":"php8-embed","label":"php8-embed&distro=openSUSE Leap 15.6","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/php8-embed&distro=openSUSE Leap 15.6","purlType":"rpm","versions":[{"text":"< 8.2.28-150600.3.16.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.28-150600.3.16.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"php8-fastcgi&distro=openSUSE Leap 15.6","name":"php8-fastcgi","label":"php8-fastcgi&distro=openSUSE Leap 15.6","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/php8-fastcgi&distro=openSUSE Leap 15.6","purlType":"rpm","versions":[{"text":"< 8.2.28-150600.3.16.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.28-150600.3.16.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"php8-fpm&distro=openSUSE Leap 15.6","name":"php8-fpm","label":"php8-fpm&distro=openSUSE Leap 15.6","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/php8-fpm&distro=openSUSE Leap 15.6","purlType":"rpm","versions":[{"text":"< 8.2.28-150600.3.16.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.28-150600.3.16.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"php8-test&distro=openSUSE Leap 15.6","name":"php8-test","label":"php8-test&distro=openSUSE Leap 15.6","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/php8-test&distro=openSUSE Leap 15.6","purlType":"rpm","versions":[{"text":"< 8.2.28-150600.3.16.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.28-150600.3.16.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"php8&distro=openSUSE Leap 15.6","name":"php8","label":"php8&distro=openSUSE Leap 15.6","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/php8&distro=openSUSE Leap 15.6","purlType":"rpm","versions":[{"text":"< 8.2.28-150600.3.16.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.28-150600.3.16.1","eol":null,"hubHref":null},{"vendor":"suse","product":"apache2-mod_php8&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","name":"apache2-mod_php8","label":"apache2-mod_php8&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/apache2-mod_php8&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","purlType":"rpm","versions":[{"text":"< 8.2.28-150600.3.16.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.28-150600.3.16.1","eol":null,"hubHref":null},{"vendor":"suse","product":"php8-embed&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","name":"php8-embed","label":"php8-embed&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/php8-embed&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","purlType":"rpm","versions":[{"text":"< 8.2.28-150600.3.16.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.28-150600.3.16.1","eol":null,"hubHref":null},{"vendor":"suse","product":"php8-fastcgi&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","name":"php8-fastcgi","label":"php8-fastcgi&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/php8-fastcgi&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","purlType":"rpm","versions":[{"text":"< 8.2.28-150600.3.16.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.28-150600.3.16.1","eol":null,"hubHref":null},{"vendor":"suse","product":"php8-fpm&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","name":"php8-fpm","label":"php8-fpm&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/php8-fpm&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","purlType":"rpm","versions":[{"text":"< 8.2.28-150600.3.16.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.28-150600.3.16.1","eol":null,"hubHref":null},{"vendor":"suse","product":"php8-test&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","name":"php8-test","label":"php8-test&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/php8-test&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","purlType":"rpm","versions":[{"text":"< 8.2.28-150600.3.16.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.28-150600.3.16.1","eol":null,"hubHref":null},{"vendor":"suse","product":"php8&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","name":"php8","label":"php8&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/php8&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP6","purlType":"rpm","versions":[{"text":"< 8.2.28-150600.3.16.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.28-150600.3.16.1","eol":null,"hubHref":null}],"affectedCount":12,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251012-1/","label":"www.suse.com/support/update/announcement/2025/suse-su-20251012-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1239664","label":"bugzilla.suse.com/1239664","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1239666","label":"bugzilla.suse.com/1239666","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1239667","label":"bugzilla.suse.com/1239667","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1239668","label":"bugzilla.suse.com/1239668","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1239669","label":"bugzilla.suse.com/1239669","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1239670","label":"bugzilla.suse.com/1239670","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11235","label":"www.suse.com/security/cve/CVE-2024-11235","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1217","label":"www.suse.com/security/cve/CVE-2025-1217","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1219","label":"www.suse.com/security/cve/CVE-2025-1219","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1734","label":"www.suse.com/security/cve/CVE-2025-1734","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1736","label":"www.suse.com/security/cve/CVE-2025-1736","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1861","label":"www.suse.com/security/cve/CVE-2025-1861","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2024-11235","CVE-2025-1217","CVE-2025-1219","CVE-2025-1734","CVE-2025-1736","CVE-2025-1861"],"downstream":[],"duplicates":[],"related":["CVE-2024-11235","CVE-2025-1217","CVE-2025-1219","CVE-2025-1734","CVE-2025-1736","CVE-2025-1861"]},"timeline":[{"kind":"published","date":"2025-03-25T12:47:30.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-05-02T04:36:15.718Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T21:50:47.414Z","stale":false,"partial":false}}