This update for php7 fixes the following issues:
- CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser (bsc#1282981).
- CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing (bsc#1283216).
- CVE-2026-6103: Archive entry injection via integer overflow in TAR parser (bsc#1282980).
- CVE-2026-91765: Denial of Service via unbounded recursion in SOAP parser (bsc#1282875).
- CVE-2026-91766: Credential disclosure via cross-origin HTTP redirects (bsc#1282876).
- CVE-2026-91767: Information disclosure via crafted TLS server certificate (bsc#1282877).
- CVE-2026-91768: Access control byp
This update for libsodium fixes the following issues:
Update to 1.0.22 (jsc#PED-16890):
* Post-quantum key encapsulation is now available. ML-KEM768, the
NIST-standardized lattice-based KEM, is accessible through the
crypto_kem_mlkem768_*() functions.
* X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for protection
against both classical and quantum adversaries, is available through the
crypto_kem_*() functions. X-Wing is the recommended KEM for most
applications.
* SHA-3 hash functions are now available as crypto_hash_sha3256_*()
and crypto_hash_sha3512_*(), with both one-shot and streaming APIs.
* Perf
This update for php7 fixes the following issue:
- CVE-2026-7260: Stack overflow in phar with circular symlinks (bsc#1273077).
Other changes:
- Allow removal of apache2-mod_php7 even if the php7 module is not enabled (bsc#1205782, bsc#1276531).
This update for php7 fixes the following issues:
- CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion
(bsc#1273077).
- CVE-2026-9672: security issues in `libgd` (bsc#1273078).
- CVE-2026-17543: improper escaping of backslashes in user-provided parameters allows for trivial SQL injection in
`ext-pgsql` (bsc#1273075).
This update for php7 fixes the following issue
- CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw (bsc#1270351).
This update for php7 fixes the following issues:
Security fixes:
- CVE-2025-14178: heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE (bsc#1255711).
Other fixes:
- Add all php7 packages to PackageHUB (unsupported), no source changes. (bsc#1251932)
This update for php7 fixes the following issues:
- CVE-2025-1220: Fixed null byte termination in hostnames (bsc#1246167)
- CVE-2025-1735: Fixed pgsql extension does not check for errors during escaping (bsc#1246146)
- CVE-2025-6491: Fixed NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (bsc#1246148)