This bug was fixed in the package php8.5 - 8.5.9-0ubuntu1
---------------
php8.5 (8.5.9-0ubuntu1) stonking; urgency=medium
* Bring new version 8.5.9-1 from salsa to Ubuntu (LP: #2156484)
(LP: #2157648)
* Remaining changes:
- d/rules: enable DTrace (LP #2088977)
- Remove secure DNS telemetry functionality (LP #2147444):
+ d/p/0045-Add-minimal-privacy-preserving-secure-DNS-telemetry-.patch:
remove the telemetry patch
+ d/control, d/control.in: remove dependencies only needed for
telemetry
+ d/rules: remove logic to setup the telemetry at build time
* Dropped changes:
- d/rules: set PHP_BUILD_PROVIDER to Ubuntu in Ubuntu builds
[ Included in Debian version 8.5.6-2 ]
- debian/patches/CVE-2025-14179.patch: GHSA-w476-322c-wpvm: [pdo_firebird]
Fix SQL injection via NUL bytes in quoted strings in
ext/pdo_firebird/firebird_driver.c,
ext/pdo_firebird/tests/ghsa-w476-322c-wpvm.phpt.
[CVE-2025-14179]
[ Included in upstream version 8.5.6 ]
- debian/patches/CVE-2026-6104.patch: GHSA-74r9-qxhc-fx53: [mbstring] Fix
out-of-bounds access in mbfl_name2encoding_ex() in
ext/mbstring/libmbfl/mbfl/mbfl_encoding.c,
ext/mbstring/tests/GHSA-74r9-qxhc-fx53.phpt.
[CVE-2026-6104]
[ Included in upstream version 8.5.6 ]
- debian/patches/CVE-2026-6722.patch: GHSA-85c2-q967-79q5: [soap] Fix stale
SOAP_GLOBAL(ref_map) pointer with Apache Map in ext/soap/php_encoding.c,
ext/soap/tests/GHSA-85c2-q967-79q5.phpt.
[CVE-2026-6722]
[ Included in upstream version 8.5.6 ]
- debian/patches/CVE-2026-6735.patch: GHSA-7qg2-v9fj-4mwv: [fpm] XSS within
status endpoint in sapi/fpm/fpm/fpm_status.c,
sapi/fpm/tests/ghsa-7qg2-v9fj-4mwv-status-xss.phpt.
[CVE-2026-6735]
[ Included in upstream version 8.5.6 ]
- debian/patches/CVE-2026-7258.patch: GHSA-m8rr-4c36-8gq4: Consistently pass
unsigned char to ctype.h functions in Zend/zend_compile.c,
Zend/zend_ini.c, Zend/zend_operators.c, Zend/zend_virtual_cwd.c,
Zend/zend_virtual_cwd.h, ext/com_dotnet/com_extension.c,
ext/date/lib/parse_date.c, ext/date/lib/parse_date.re,
ext/date/lib/parse_iso_intervals.c, ext/date/lib/parse_iso_intervals.re,
ext/date/lib/timelib.c, ext/filter/logical_filters.c, ext/ftp/ftp.c,
ext/gd/libgd/gd_xbm.c, ext/gmp/gmp.c, ext/intl/locale/locale_methods.cpp,
ext/mbstring/mbstring.c, ext/mbstring/php_mbregex.c, ext/pcre/php_pcre.c,
ext/pdo/pdo.c, ext/pdo/pdo_sql_parser.re, ext/standard/dl.c,
ext/standard/exec.c, ext/standard/file.c, ext/standard/filters.c,
ext/standard/formatted_print.c, ext/standard/ftp_fopen_wrapper.c,
ext/standard/html.c, ext/standard/math.c, ext/standard/metaphone.c,
ext/standard/quot_print.c, ext/standard/scanf.c, ext/standard/soundex.c,
ext/standard/string.c, ext/standard/strnatcmp.c, ext/standard/type.c,
ext/standard/url.c, ext/standard/url_scanner_ex.re,
ext/standard/versioning.c, main/SAPI.c, main/fopen_wrappers.c,
main/php_ini.c, main/php_ini_builder.c, main/php_variables.c,
main/rfc1867.c, main/snprintf.c, main/spprintf.c, main/streams/streams.c,
main/streams/transports.c, sapi/cli/php_cli_server.c,
sapi/fpm/fpm/fpm_conf.c, sapi/litespeed/lsapi_main.c,
sapi/litespeed/lsapilib.c, sapi/phpdbg/phpdbg_cmd.c,
sapi/phpdbg/phpdbg_prompt.c, sapi/phpdbg/phpdbg_utils.c, win32/sendmail.c.
[CVE-2026-7258]
[ Included in upstream version 8.5.6 ]
- debian/patches/CVE-2026-7259.patch: GHSA-wm6j-2649-pv75: [mbstring] Fix
null pointer dereference in php_mb_check_encoding() via
mb_ereg_search_init() in Zend/tests/GHSA-wm6j-2649-pv75.phpt,
ext/mbstring/php_mbregex.c.
[CVE-2026-7259]
[ Included in upstream version 8.5.6 ]
- debian/patches/CVE-2026-7261.patch: GHSA-m33r-qmcv-p97q: [soap] Fix use-
after-free after header parsing failure with SOAP_PERSISTENCE_SESSION in
ext/soap/soap.c, ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt.
[CVE-2026-7261]
[ Included in upstream version 8.5.6 ]
- debian/patches/CVE-2026-7262.patch: GHSA-hmxp-6pc4-f3vv: [soap] Fix broken
Apache map value NULL check in ext/soap/php_encoding.c,
ext/soap/tests/GHSA-hmxp-6pc4-f3vv.phpt.
[CVE-2026-7262]
[ Included in upstream version 8.5.6 ]
- debian/patches/CVE-2026-7263.patch: Fix GH-21548: Dom\XMLDocument::C14N()
emits duplicate xmlns declarations after setAttributeNS(). in NEWS,
ext/dom/node.c, ext/dom/tests/modern/xml/gh21548.phpt.
[CVE-2026-7263]
[ Included in upstream version 8.5.6 ]
- debian/patches/CVE-2026-7568.patch: GHSA-96wq-48vp-hh57: [metaphone] Fix
signed integer overflow of char array offset in ext/standard/metaphone.c,
ext/standard/tests/GHSA-96wq-48vp-hh57.phpt.
[CVE-2026-7568]
[ Included in upstream version 8.5.6 ]
- debian/patches/CVE-2026-12184.patch: Fix NULL deref when enabling TLS
fails and the peer name needs to be reset in
ext/openssl/tests/gh21031.phpt,
ext/openssl/tests/sni_server_cs_expired.pem,
ext/standard/http_fopen_wrapper.c.
[CVE-2026-12184]
[ Included in upstream version 8.5.6 ]
- debian/patches/CVE-2026-14355.patch: ext/openssl: openssl_encrypt() zend
mm heap overflow on AES-WRAP-PAD mode. in
ext/openssl/openssl_backend_common.c, ext/openssl/tests/gh22186.phpt.
[CVE-2026-14355]
[ Included in upstream version 8.5.8 ]
php8.5 (8.5.9-1) experimental; urgency=medium
* New upstream version 8.5.9
+ [CVE-2026-17544]: Out-of-bounds write in bccomp()
+ [CVE-2026-17543]: SQL injection via E'...' backslash breakout
+ [CVE-2026-7260]: Crash via recursive symlinks
php8.5 (8.5.8-1) experimental; urgency=medium
* New upstream version 8.5.8
+ [CVE-2026-14355]: Memory corruption (zend_mm_heap corrupted) in
openssl_encrypt with AES-WRAP-PAD
php8.5 (8.5.7-1) experimental; urgency=medium
* New upstream version 8.5.7
+ [CVE-2026-44927]: In uriparser before 1.0.2, there is pointer
difference truncation to int in various places
+ [CVE-2026-44928]: In uriparser before 1.0.2, the function family
EqualsUri can misclassify two unequal URIs as equal
* Update the php-fpm-reopenlogs script to not depend on PID file
php8.5 (8.5.6-3) experimental; urgency=medium
* Remove PrivateTmp=true from php-fpm.service unit
php8.5 (8.5.6-2) experimental; urgency=medium
[ Ondřej Surý ]
* Switch litespeed unit type to 'simple'
* Merge hardening from sapi/fpm/php-fpm.service.in into debian/php-fpm.service
* Add d/NEWS about the systemd unit file hardening
[ Renan Rodrigo ]
* Check dpkg-vendor to set the PHP_BUILD_PROVIDER value
[ MichaIng ]
* Do not create obsolete PID file
[ Theral Mackey ]
* Do not serve php as plaintext, if we turn off php engine
[ Christian Göttsche ]
* Update compiler flags
php8.5 (8.5.6-1) experimental; urgency=medium
* New upstream version 8.5.6
php8.5 (8.5.5-1) experimental; urgency=medium
* New upstream version 8.5.5
-- Renan Rodrigo <[email protected]> Wed, 05 Aug 2026 23:40:54 -0300
** Changed in: php8.5 (Ubuntu)
Status: Fix Committed => Fix Released
** CVE added: https://cve.org/CVERecord?id=CVE-2025-14179
** CVE added: https://cve.org/CVERecord?id=CVE-2026-12184
** CVE added: https://cve.org/CVERecord?id=CVE-2026-14355
** CVE added: https://cve.org/CVERecord?id=CVE-2026-17543
** CVE added: https://cve.org/CVERecord?id=CVE-2026-17544
** CVE added: https://cve.org/CVERecord?id=CVE-2026-44927
** CVE added: https://cve.org/CVERecord?id=CVE-2026-44928
** CVE added: https://cve.org/CVERecord?id=CVE-2026-6104
** CVE added: https://cve.org/CVERecord?id=CVE-2026-6722
** CVE added: https://cve.org/CVERecord?id=CVE-2026-6735
** CVE added: https://cve.org/CVERecord?id=CVE-2026-7258
** CVE added: https://cve.org/CVERecord?id=CVE-2026-7259
** CVE added: https://cve.org/CVERecord?id=CVE-2026-7260
** CVE added: https://cve.org/CVERecord?id=CVE-2026-7261
** CVE added: https://cve.org/CVERecord?id=CVE-2026-7262
** CVE added: https://cve.org/CVERecord?id=CVE-2026-7263
** CVE added: https://cve.org/CVERecord?id=CVE-2026-7568
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2156484
Title:
Merge php8.5 from Debian for stonking cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/php8.5/+bug/2156484/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
