-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 24 Sep 2026 19:16:18 +0200 Source: php8.4 Architecture: source Version: 8.4.26-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian PHP Maintainers <[email protected]> Changed-By: Ondřej Surý <[email protected]> Changes: php8.4 (8.4.26-1~deb13u1) trixie-security; urgency=high . * New upstream version 8.4.26 + [CVE-2026-91768]: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison. + [CVE-2025-1218]: Various packet overreads in mysqlnd wire protocol. + [CVE-2026-91769]: TLS hostname verification falls back to CN after SAN mismatch. + [CVE-2026-91767]: Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN. + [CVE-2026-6103]: Integer overflow in phar_tar_number() allowing TAR archive entry injection. + [CVE-2026-91765]: Unbounded recursion in server-side cleanup_xml_node(). + [CVE-2025-14181]: Integer overflow to buffer overflow in SOAP HTTP parsing. + [CVE-2026-93682]: Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header. + [CVE-2026-92842]: Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL. + [CVE-2026-91766]: Cross-origin credential leak in HTTP stream wrapper redirects. + [CVE-2026-17545]: Reserved device names are not rejected before file and stream I/O. Checksums-Sha1: eba5df83e859af2b9857775d32708f0e20dd80f7 5619 php8.4_8.4.26-1~deb13u1.dsc ebc70fb6f8f41c7a0e406fdccb5610f4de9e8309 13791528 php8.4_8.4.26.orig.tar.xz 3e50030c312ca12d1cf0ccecd407ba1d95f564b0 833 php8.4_8.4.26.orig.tar.xz.asc bc24d6043c6f2ff0a74ca28237ab46bf578b8274 75100 php8.4_8.4.26-1~deb13u1.debian.tar.xz 9aacc3a962f0cbff24136ecb44506ef0cb73d882 34740 php8.4_8.4.26-1~deb13u1_amd64.buildinfo Checksums-Sha256: f00a9877965fedd1bf1e8f471ca43125f487454c8e731b56f2c1692a2ef5bef8 5619 php8.4_8.4.26-1~deb13u1.dsc 32a2de53862ad44ed4a5005244ce4f1b50c271e74dced215449a4443b40569f1 13791528 php8.4_8.4.26.orig.tar.xz 60e78a39e9a22abbb21b60817cd5c9591d0fe208e398207d2d2cc8d0b7892fb5 833 php8.4_8.4.26.orig.tar.xz.asc 0403211da38ccacfe8bcd4ddca8342d5cc3ac1aab4a9e36bec302b3dae32bfee 75100 php8.4_8.4.26-1~deb13u1.debian.tar.xz 5ce0db6b544068a01dafd241bf7c2d1ede74c877196eb0458895f02fe3de21c6 34740 php8.4_8.4.26-1~deb13u1_amd64.buildinfo Files: fbd0e15d0513fa34f7023ec536417749 5619 php optional php8.4_8.4.26-1~deb13u1.dsc 8c9d126a31b3074d86199d16ad8a07e7 13791528 php optional php8.4_8.4.26.orig.tar.xz afc9bb33e0c1c280ec3a4c9196d6f57d 833 php optional php8.4_8.4.26.orig.tar.xz.asc c7b0864af9362dd01a980e13bbc33505 75100 php optional php8.4_8.4.26-1~deb13u1.debian.tar.xz 8b2135f3e3a30193883468c7f629ea67 34740 php optional php8.4_8.4.26-1~deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmq1cjRfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u WcLrDg/+JORE0elqbZVMM6CQyi60QzHs3peP8Elwy+2O9c6QKywCCcWYU1ApGPD3 hiLY1M/HAGxeWbiuq8iXd3C9r/Ys5hR736+PoONRRAWR0cQOAtPGUrva/4TJ9KUR 9iBCrcsakSxYAeg9+9ZfYmmyR1KDmZWCW/SDOGS72iZj/KEiXXOdUmv4hwrv17/O uD0hk87V5jeCOMO3XS1C8epfMN5pCjE0E7aAh0dmnvcFITScjk2OpdxhvhF9a5OD NUi5icP+vDWgHbjuEx9/OZ1AWsqLj7F9FuDqs04Cr/0AU1Z8RZE++4dVo2ZM8vuw W848xhyrlwFnYVzl8vex1um94n0t1tuwKZvcPMFIpAnEjafTzpPNMmYUTYP9Qz7+ fx3m+4cD50o5vDkc+m0r0pqopGOfEZ7Xv6iKFpw0t6mynamuPH6lAN3qPLjDJ/kh /gi2FTmNDO5wQ6V6sOfi9nBd3y1MEHAAsX1fnfcBfe7wMQj450oiFBmypfuzXdqj wqDS7zGAqGJnZ8URXciQ1NziAEjijP21Jwqpfw6euDqdOJqLZ291PSIqdWnnhVkf niHQIBoBZ53ewG64NxYHr9asCuTYffzF0Yn+3CAy5/giWJ+7juh7HXao/+dgx7BV eCMXBUxf8Z77mU0iNouiPLxoPHpdWel5WaU/ouGiaGdEr46WIzw= =juGs -----END PGP SIGNATURE-----
pgpy6TG8tVwq0.pgp
Description: PGP signature
