SB20261105110 - SUSE update for php8
Published: November 5, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2025-1218)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker on the local network to trigger out-of-bounds reads of process heap memory and potentially cause a denial of service in a PHP application.
The vulnerability exists due to out-of-bounds reads in PHP's mysqlnd wire protocol parser when processing truncated MySQL server packets without verifying that enough bytes remain for each field. A remote attacker on the local network can send specially crafted packets from a malicious or compromised MySQL server to make the client read beyond packet buffer boundaries and potentially crash the application.
The bytes read beyond the buffer influence parsed field values but are not returned to the server.
2) Heap-based buffer overflow (CVE-ID: CVE-2025-14181)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or corrupt heap memory in a PHP SOAP client.
The vulnerability exists due to a heap-based buffer overflow in get_http_body() in ext/soap/php_http.c when processing chunked HTTP responses on builds where the compiler removes a buffer growth check that relies on undefined signed integer overflow. A remote attacker can supply a malicious SOAP server response with Transfer-Encoding: chunked and two successive chunk sizes of 0x7fffffff to cause an undersized allocation and subsequent out-of-bounds writes, resulting in a crash or memory corruption.
Exploitation requires the client to accept a multi-gigabyte response.
3) Integer overflow (CVE-ID: CVE-2026-6103)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject archive entries and cause attacker-controlled files to be written during TAR archive extraction.
The vulnerability exists due to an integer overflow in PHP's Phar TAR phar_tar_number() function when parsing octal entry sizes into a 32-bit unsigned integer without overflow checks. A remote attacker can supply a crafted TAR archive with a size field of 40000000000, which wraps to zero and causes file content to be interpreted as subsequent TAR headers, to inject entries that PharData exposes and extractTo() writes to disk.
4) Uncontrolled Recursion (CVE-ID: CVE-2026-91765)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the SOAP XML parser's cleanup_xml_node() function when handling a SOAP request containing deeply nested XML elements. A remote attacker can send a specially crafted SOAP request to cause a denial of service.
5) Insufficiently protected credentials (CVE-ID: CVE-2026-91766)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose credentials.
The vulnerability exists due to improper credential forwarding in the HTTP stream wrapper when following a cross-origin redirect. A remote attacker can control a redirect target to disclose credentials.
The issue affects user-supplied Authorization, Cookie, and Proxy-Authorization headers, including redirects from HTTPS to HTTP.
6) Heap-based buffer overflow (CVE-ID: CVE-2026-91767)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to a heap-based buffer overflow in php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c when verifying a TLS server certificate wildcard name against a shorter hostname. A remote attacker can present a crafted TLS server certificate with a wildcard common name to disclose sensitive information.
The crafted certificate must be trusted by the certificate authority in use or be presented by a server controlled by the attacker.
7) Incorrect Comparison (CVE-ID: CVE-2026-91768)
CWE-ID: CWE-697 - Incorrect Comparison
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass the FastCGI access control and access the endpoint.
The vulnerability exists due to an incorrect comparison in fcgi_is_allowed() in main/fastcgi.c when validating IPv6 client addresses against listen.allowed_clients. A remote attacker can send a FastCGI request from an IPv6 address sharing the first 96 bits with an allowed address to bypass the FastCGI access control and access the endpoint.
Only deployments using FastCGI over IPv6 TCP and relying on listen.allowed_clients as a security boundary are affected.
8) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-91769)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker on the local network to impersonate a trusted TLS server and disclose sensitive information.
The vulnerability exists due to improper certificate hostname validation in PHP's OpenSSL stream function php_openssl_apply_peer_verification_policy() when verifying a peer certificate with non-matching subjectAltName entries. A remote attacker on the local network can present a client-trusted certificate whose Common Name matches the requested peer_name, such as CN=victim.test with SAN=DNS:attacker.test, to bypass hostname verification and potentially obtain sensitive information sent to the impersonated server.
9) Out-of-bounds read (CVE-ID: CVE-2026-92842)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information from adjacent heap memory through stream filter output.
The vulnerability exists due to an out-of-bounds read in PHP's convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters when emitting line breaks from an option allocation truncated at an embedded NUL byte while retaining its original length. A remote attacker can supply a line-break-chars option containing an embedded NUL byte through an application that forwards request data into filter options to copy adjacent heap bytes into filter output returned by the application.
10) Out-of-bounds read (CVE-ID: CVE-2026-93682)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose limited information.
The vulnerability exists due to an out-of-bounds read in the HTTP stream wrapper redirect handling when processing a redirect response with an empty Location header. A remote attacker can operate a server that a PHP application fetches from, or redirect a request to such a server, to disclose limited information.
At most one bit, indicating whether the out-of-bounds byte is zero, is observable through the request path received by the server.
Remediation
Install update from vendor's website.