========================================================================== Ubuntu Security Notice USN-8564-1 July 20, 2026
php8.1, php8.3, php8.5 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in PHP. Software Description: - php8.5: HTML-embedded scripting language interpreter - php8.3: HTML-embedded scripting language interpreter - php8.1: HTML-embedded scripting language interpreter Details: It was discovered that PHP incorrectly handled certain TLS setup failures, resulting in a NULL pointer dereference. An attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-12184) It was discovered that PHP contained a buffer allocation flaw in the OpenSSL extension when using the AES-WRAP-PAD algorithm. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-14355) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS php8.5 8.5.4-0ubuntu1.2 Ubuntu 24.04 LTS php8.3 8.3.6-0ubuntu0.24.04.10 Ubuntu 22.04 LTS php8.1 8.1.2-1ubuntu2.25 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8564-1 CVE-2026-12184, CVE-2026-14355 Package Information: https://launchpad.net/ubuntu/+source/php8.5/8.5.4-0ubuntu1.2 https://launchpad.net/ubuntu/+source/php8.3/8.3.6-0ubuntu0.24.04.10 https://launchpad.net/ubuntu/+source/php8.1/8.1.2-1ubuntu2.25
signature.asc
Description: OpenPGP digital signature
