p PatchFirst

SUSE-SU-2026:20146-1

SUSE-SU-2026:20146-1 · Security update for php8

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This update for php8 fixes the following issues: Version update to 8.4.16: Security fixes: - CVE-2025-14177: getimagesize() function may leak uninitialized heap memory into the APPn segments when reading images in multi-chunk mode (bsc#1255710). - CVE-2025-14178: heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE (bsc#1255711). - CVE-2025-14180: null pointer dereference in pdo_parse_params() function when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled (bsc#1255712). Other fixes: - php8 contains Directories owned by wwwrun but does not require User. (bsc#1255043)

Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache2-mod_php8 SUSE:Linux Enterprise Server 16.0

    Affected ranges
    • ECOSYSTEM: < 8.4.16-160000.1.1

    Update to 8.4.16-160000.1.1

  • php8 SUSE:Linux Enterprise Server 16.0

    Affected ranges
    • ECOSYSTEM: < 8.4.16-160000.1.1

    Update to 8.4.16-160000.1.1

  • php8-embed SUSE:Linux Enterprise Server 16.0

    Affected ranges
    • ECOSYSTEM: < 8.4.16-160000.1.1

    Update to 8.4.16-160000.1.1

  • php8-fastcgi SUSE:Linux Enterprise Server 16.0

    Affected ranges
    • ECOSYSTEM: < 8.4.16-160000.1.1

    Update to 8.4.16-160000.1.1

  • php8-fpm SUSE:Linux Enterprise Server 16.0

    Affected ranges
    • ECOSYSTEM: < 8.4.16-160000.1.1

    Update to 8.4.16-160000.1.1

  • apache2-mod_php8 SUSE:Linux Enterprise Server for SAP applications 16.0

    Affected ranges
    • ECOSYSTEM: < 8.4.16-160000.1.1

    Update to 8.4.16-160000.1.1

  • php8 SUSE:Linux Enterprise Server for SAP applications 16.0

    Affected ranges
    • ECOSYSTEM: < 8.4.16-160000.1.1

    Update to 8.4.16-160000.1.1

  • php8-embed SUSE:Linux Enterprise Server for SAP applications 16.0

    Affected ranges
    • ECOSYSTEM: < 8.4.16-160000.1.1

    Update to 8.4.16-160000.1.1

  • php8-fastcgi SUSE:Linux Enterprise Server for SAP applications 16.0

    Affected ranges
    • ECOSYSTEM: < 8.4.16-160000.1.1

    Update to 8.4.16-160000.1.1

  • php8-fpm SUSE:Linux Enterprise Server for SAP applications 16.0

    Affected ranges
    • ECOSYSTEM: < 8.4.16-160000.1.1

    Update to 8.4.16-160000.1.1

Original sources

Check your server →