During the month of October 2026 and on behalf of Freexian, I worked on the following:
php --- Uploaded php8.2=8.2.34-1~deb12u1 and issued DLA-4819-1. https://lists.debian.org/msgid-search/[email protected] * CVE-2025-1218: Various packet overreads in mysqlnd wire protocol * CVE-2025-14181: Integer overflow to buffer overflow in SOAP HTTP parsing * CVE-2026-6103: Phar TAR phar_tar_number() Integer Overflow allowing Archive Entry Injection * CVE-2026-91765: Unbounded recursion in server-side cleanup_xml_node() * CVE-2026-91766: Cross-origin credential leak in HTTP stream wrapper redirects * CVE-2026-91767: Heap-buffer-overflow in php_openssl_matches_wildcard_name() on crafted server cert wildcard CN * CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison * CVE-2026-91769: TLS hostname verification falls back to CN after SAN Mismatch * CVE-2026-92842: OOB read / info leak in convert.* stream filters when line-break-chars contains NUL * CVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header Also, uploaded php7.4=7.4.33-1+deb11u13 (bullseye), php7.3=7.3.31-1~deb10u15 (buster) and php7.0=7.0.33-0+deb9u25 (stretch), and issued ELA-184[789]-1 for the above vulnerabilities. https://www.freexian.com/lts/extended/updates/ela-1847-1-php7.4/ https://www.freexian.com/lts/extended/updates/ela-1848-1-php7.3/ https://www.freexian.com/lts/extended/updates/ela-1849-1-php7.0/ I decided to postpone the fix for CVE-2025-1218 for php7.0 for now. The severity is quite low (it assumes a malicious or compromised MySQL server) and the fix quite intrusive due to massive changes in ext/mysqlnd between PHP 7.0 and PHP 7.3. I have a WIP backport but it would needs more work and extensive testing. PHP upstream announced the php2shell embargoed vulnerabilities two weeks later. Thanks to Ondřej Surý for providing embargoed patches so the packages could be prepared and tested prior to disclosure! Uploaded php8.2=8.2.35-1~deb12u1 and issued DLA-4848-1, and uploaded php7.4=7.4.33-1+deb11u13, php7.3=7.3.31-1~deb10u15 and php7.0=7.0.33-0+deb9u25. Thanks to Santiago Ruano Rincón for issuing the ELAs (ELA-185[3-5]-1) as it had got quite late here. https://lists.debian.org/msgid-search/[email protected] * CVE-2026-109618: RCE via OOM corruption * CVE-2026-109619: RCE via stale global state roundcube --------- Uploaded 1.6.5+dfsg-1+deb12u12 and issued DLA-4823-1. https://lists.debian.org/msgid-search/[email protected] This update fixes several vulnerabilities for which no CVE ID has been assigned yet: * CSS declaration smuggling via un-encoded ampersand emission * CSS property injection via body `background` attribute * Email header injection via bare CR in the subject field * Email header injection via C-escape `\r` in the recipient display name * Email header injection via identity's organization field * Zero-click stored XSS via TNEF MIME tag injection in the attachment URL * XSS in the HTML editor using text/enriched part content * Cross-user access in contact group membership (add/remove) in the SQL address book * `is_local_url()` bypass via trailing-dot FQDN in stylesheet URL * Remote content blocking bypass via CSS escapes in FuncIRI attributes * Remote-content blocker bypass via SVG SMIL src animation dovecot ------- Finished testing and uploaded 1:2.3.19.1+dfsg1-2.1+deb12u7 and issued DLA-4873-1. https://lists.debian.org/msgid-search/[email protected] * CVE-2026-27852: DoS by sending mail with bad header * CVE-2026-33263: submission-login crash when mail_max_userip_connections is reached * CVE-2026-33604: SMTP Smuggling via missing dot-stuffing after bare carriage return * CVE-2026-33605: managesieve-login crash via crafted command before authenticating * CVE-2026-33606: dsync protocol injection vulnerability via crafted user mail content * CVE-2026-33607: CPU denial of service via IMAP LIST match_sub() exponential backtracking * CVE-2026-40013 [pigeonhole]: Stack buffer underflow in managesieve CHECKSCRIPT and PUTSCRIPT commands * CVE-2026-40014: IMAP THREAD REFERENCES O(N²) CPU DoS via crafted references header * CVE-2026-40015: imap-hibernate crash via crafted commands * CVE-2026-40017: IMAP THREAD O(M³) CPU DoS via CRC32 hash collision in strmap * CVE-2026-40018: SQL injection vulnerability via multi-byte escaping * CVE-2026-40203: IMAP COMPRESS information disclosure via CRIME-style cross-command compression oracle attacks * CVE-2026-40204: ACL restriction bypass via lda_mailbox_autocreate() * CVE-2026-40205: OAuth2 passdb scope enforcement bypass via OR semantics in remote validation path * CVE-2026-42007: Sieve editheader RCE via use-after-free in the mail editing code * CVE-2026-42008: nopassword injection via trusted proxy due to missing namespace in XCLIENT FORWARD= bare tokens * CVE-2026-42391: Denial of service via IMAP ID command with a a very large number of parameters before logging in * CVE-2026-42393: doveadm_password or api key length can be leaked via timing attacks * CVE-2026-42394: Arbitrary file disclosure due to symlink traversal flaw * CVE-2026-42395: login process crash via NUL-Byte XCLIENT FORWARD payload * CVE-2026-52681 [pigeonhole]: Denial of service via CPU resource usage bypass caused by repeatedly changing the active script * CVE-2026-52687: Denial of service via invalid IMAP COMPRESS algorithm * CVE-2026-73208: The "aud" claim is used as fallback for missing scope claim * CVE-2026-73209: imap-login crash due to self-recursion on zero-output decompress chunks Also, finished testing 1:2.3.13+dfsg1-2+deb11u5 for bullseye, and prepared and tested 1:2.3.4.1-5+deb10u10 for buster. Due to a technical issue with the staging build system these are not available in the archive yet, but should appear in the next days. Thanks to the sponsors for financing the above, and to Freexian for coordinating! -- Guilhem.
signature.asc
Description: PGP signature
