{"id":"SUSE-SU-2026:3509-1","summary":"Security update for php8","details":"This update for php8 fixes the following issues:\n  \nUpdate to version 8.3.33.\n\nSecurity issues fixed:\n\n- CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion\n  (bsc#1273077).\n- CVE-2026-9672: security issues in `libgd` (bsc#1273078).\n- CVE-2026-17543: improper escaping of backslashes in user-provided parameters allows for trivial SQL injection in\n  `ext-pgsql` (bsc#1273075).\n","modified":"2026-08-06T11:15:07.856066442Z","published":"2026-08-05T13:48:21Z","related":["CVE-2026-17543","CVE-2026-7260","CVE-2026-9672"],"upstream":["CVE-2026-17543","CVE-2026-7260","CVE-2026-9672"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263509-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1273075"},{"type":"REPORT","url":"https://bugzilla.suse.com/1273077"},{"type":"REPORT","url":"https://bugzilla.suse.com/1273078"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-17543"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-7260"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-9672"}],"affected":[{"package":{"name":"apache2-mod_php8","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","purl":"pkg:rpm/suse/apache2-mod_php8&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.33-150700.3.18.1"}]}],"ecosystem_specific":{"binaries":[{"php8-fastcgi":"8.3.33-150700.3.18.1","php8-xmlwriter":"8.3.33-150700.3.18.1","php8-ctype":"8.3.33-150700.3.18.1","php8-bz2":"8.3.33-150700.3.18.1","php8-sysvsem":"8.3.33-150700.3.18.1","php8-test":"8.3.33-150700.3.18.1","php8-ftp":"8.3.33-150700.3.18.1","php8-pdo":"8.3.33-150700.3.18.1","php8-dba":"8.3.33-150700.3.18.1","php8-exif":"8.3.33-150700.3.18.1","php8-sysvshm":"8.3.33-150700.3.18.1","php8-shmop":"8.3.33-150700.3.18.1","php8-bcmath":"8.3.33-150700.3.18.1","php8-openssl":"8.3.33-150700.3.18.1","php8-mysql":"8.3.33-150700.3.18.1","php8-gmp":"8.3.33-150700.3.18.1","php8-phar":"8.3.33-150700.3.18.1","php8-soap":"8.3.33-150700.3.18.1","php8-posix":"8.3.33-150700.3.18.1","php8-fileinfo":"8.3.33-150700.3.18.1","php8-xsl":"8.3.33-150700.3.18.1","php8-calendar":"8.3.33-150700.3.18.1","php8-ldap":"8.3.33-150700.3.18.1","php8-enchant":"8.3.33-150700.3.18.1","php8-curl":"8.3.33-150700.3.18.1","php8-snmp":"8.3.33-150700.3.18.1","php8-devel":"8.3.33-150700.3.18.1","php8-opcache":"8.3.33-150700.3.18.1","php8-zlib":"8.3.33-150700.3.18.1","php8-sodium":"8.3.33-150700.3.18.1","php8-iconv":"8.3.33-150700.3.18.1","php8-pcntl":"8.3.33-150700.3.18.1","php8-sockets":"8.3.33-150700.3.18.1","php8-sqlite":"8.3.33-150700.3.18.1","php8":"8.3.33-150700.3.18.1","php8-xmlreader":"8.3.33-150700.3.18.1","php8-zip":"8.3.33-150700.3.18.1","php8-pgsql":"8.3.33-150700.3.18.1","php8-fpm":"8.3.33-150700.3.18.1","php8-odbc":"8.3.33-150700.3.18.1","apache2-mod_php8":"8.3.33-150700.3.18.1","php8-dom":"8.3.33-150700.3.18.1","php8-tidy":"8.3.33-150700.3.18.1","php8-embed":"8.3.33-150700.3.18.1","php8-mbstring":"8.3.33-150700.3.18.1","php8-tokenizer":"8.3.33-150700.3.18.1","php8-gd":"8.3.33-150700.3.18.1","php8-sysvmsg":"8.3.33-150700.3.18.1","php8-gettext":"8.3.33-150700.3.18.1","php8-cli":"8.3.33-150700.3.18.1","php8-intl":"8.3.33-150700.3.18.1","php8-readline":"8.3.33-150700.3.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3509-1.json"}},{"package":{"name":"php8","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","purl":"pkg:rpm/suse/php8&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.33-150700.3.18.1"}]}],"ecosystem_specific":{"binaries":[{"php8-fastcgi":"8.3.33-150700.3.18.1","php8-snmp":"8.3.33-150700.3.18.1","php8-pdo":"8.3.33-150700.3.18.1","php8-sodium":"8.3.33-150700.3.18.1","php8-bz2":"8.3.33-150700.3.18.1","php8-sockets":"8.3.33-150700.3.18.1","php8-embed":"8.3.33-150700.3.18.1","php8-tidy":"8.3.33-150700.3.18.1","php8-bcmath":"8.3.33-150700.3.18.1","php8-calendar":"8.3.33-150700.3.18.1","php8-iconv":"8.3.33-150700.3.18.1","php8-curl":"8.3.33-150700.3.18.1","php8-phar":"8.3.33-150700.3.18.1","php8-openssl":"8.3.33-150700.3.18.1","php8-mbstring":"8.3.33-150700.3.18.1","php8-gmp":"8.3.33-150700.3.18.1","php8":"8.3.33-150700.3.18.1","php8-xsl":"8.3.33-150700.3.18.1","php8-enchant":"8.3.33-150700.3.18.1","php8-fpm":"8.3.33-150700.3.18.1","php8-intl":"8.3.33-150700.3.18.1","php8-xmlreader":"8.3.33-150700.3.18.1","php8-xmlwriter":"8.3.33-150700.3.18.1","php8-dom":"8.3.33-150700.3.18.1","php8-zlib":"8.3.33-150700.3.18.1","php8-pgsql":"8.3.33-150700.3.18.1","php8-cli":"8.3.33-150700.3.18.1","php8-test":"8.3.33-150700.3.18.1","php8-sqlite":"8.3.33-150700.3.18.1","php8-soap":"8.3.33-150700.3.18.1","php8-ctype":"8.3.33-150700.3.18.1","apache2-mod_php8":"8.3.33-150700.3.18.1","php8-sysvmsg":"8.3.33-150700.3.18.1","php8-devel":"8.3.33-150700.3.18.1","php8-gettext":"8.3.33-150700.3.18.1","php8-ftp":"8.3.33-150700.3.18.1","php8-tokenizer":"8.3.33-150700.3.18.1","php8-exif":"8.3.33-150700.3.18.1","php8-mysql":"8.3.33-150700.3.18.1","php8-odbc":"8.3.33-150700.3.18.1","php8-readline":"8.3.33-150700.3.18.1","php8-opcache":"8.3.33-150700.3.18.1","php8-posix":"8.3.33-150700.3.18.1","php8-ldap":"8.3.33-150700.3.18.1","php8-fileinfo":"8.3.33-150700.3.18.1","php8-shmop":"8.3.33-150700.3.18.1","php8-dba":"8.3.33-150700.3.18.1","php8-zip":"8.3.33-150700.3.18.1","php8-sysvsem":"8.3.33-150700.3.18.1","php8-sysvshm":"8.3.33-150700.3.18.1","php8-pcntl":"8.3.33-150700.3.18.1","php8-gd":"8.3.33-150700.3.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3509-1.json"}},{"package":{"name":"php8-embed","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","purl":"pkg:rpm/suse/php8-embed&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.33-150700.3.18.1"}]}],"ecosystem_specific":{"binaries":[{"php8-zip":"8.3.33-150700.3.18.1","php8-sodium":"8.3.33-150700.3.18.1","php8-posix":"8.3.33-150700.3.18.1","php8-sysvsem":"8.3.33-150700.3.18.1","php8-enchant":"8.3.33-150700.3.18.1","php8-zlib":"8.3.33-150700.3.18.1","php8-gd":"8.3.33-150700.3.18.1","php8-phar":"8.3.33-150700.3.18.1","php8-fastcgi":"8.3.33-150700.3.18.1","php8-ldap":"8.3.33-150700.3.18.1","php8-dba":"8.3.33-150700.3.18.1","php8-odbc":"8.3.33-150700.3.18.1","php8-readline":"8.3.33-150700.3.18.1","php8-fileinfo":"8.3.33-150700.3.18.1","php8-sysvshm":"8.3.33-150700.3.18.1","php8-opcache":"8.3.33-150700.3.18.1","php8-sqlite":"8.3.33-150700.3.18.1","php8-test":"8.3.33-150700.3.18.1","php8-bz2":"8.3.33-150700.3.18.1","apache2-mod_php8":"8.3.33-150700.3.18.1","php8-exif":"8.3.33-150700.3.18.1","php8-xmlwriter":"8.3.33-150700.3.18.1","php8-curl":"8.3.33-150700.3.18.1","php8-fpm":"8.3.33-150700.3.18.1","php8-tidy":"8.3.33-150700.3.18.1","php8-openssl":"8.3.33-150700.3.18.1","php8-dom":"8.3.33-150700.3.18.1","php8-cli":"8.3.33-150700.3.18.1","php8-gettext":"8.3.33-150700.3.18.1","php8-xsl":"8.3.33-150700.3.18.1","php8-mbstring":"8.3.33-150700.3.18.1","php8-tokenizer":"8.3.33-150700.3.18.1","php8-calendar":"8.3.33-150700.3.18.1","php8-xmlreader":"8.3.33-150700.3.18.1","php8-pdo":"8.3.33-150700.3.18.1","php8-sysvmsg":"8.3.33-150700.3.18.1","php8-embed":"8.3.33-150700.3.18.1","php8":"8.3.33-150700.3.18.1","php8-devel":"8.3.33-150700.3.18.1","php8-snmp":"8.3.33-150700.3.18.1","php8-mysql":"8.3.33-150700.3.18.1","php8-pgsql":"8.3.33-150700.3.18.1","php8-iconv":"8.3.33-150700.3.18.1","php8-bcmath":"8.3.33-150700.3.18.1","php8-ctype":"8.3.33-150700.3.18.1","php8-soap":"8.3.33-150700.3.18.1","php8-shmop":"8.3.33-150700.3.18.1","php8-sockets":"8.3.33-150700.3.18.1","php8-gmp":"8.3.33-150700.3.18.1","php8-ftp":"8.3.33-150700.3.18.1","php8-intl":"8.3.33-150700.3.18.1","php8-pcntl":"8.3.33-150700.3.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3509-1.json"}},{"package":{"name":"php8-fastcgi","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","purl":"pkg:rpm/suse/php8-fastcgi&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.33-150700.3.18.1"}]}],"ecosystem_specific":{"binaries":[{"php8-bz2":"8.3.33-150700.3.18.1","php8-openssl":"8.3.33-150700.3.18.1","php8-pdo":"8.3.33-150700.3.18.1","php8-gd":"8.3.33-150700.3.18.1","php8-test":"8.3.33-150700.3.18.1","php8-shmop":"8.3.33-150700.3.18.1","php8-xmlwriter":"8.3.33-150700.3.18.1","php8-opcache":"8.3.33-150700.3.18.1","php8-ftp":"8.3.33-150700.3.18.1","php8-embed":"8.3.33-150700.3.18.1","php8-snmp":"8.3.33-150700.3.18.1","php8-readline":"8.3.33-150700.3.18.1","php8-sqlite":"8.3.33-150700.3.18.1","php8-phar":"8.3.33-150700.3.18.1","php8-sysvshm":"8.3.33-150700.3.18.1","php8-xsl":"8.3.33-150700.3.18.1","php8-posix":"8.3.33-150700.3.18.1","php8-mbstring":"8.3.33-150700.3.18.1","php8-curl":"8.3.33-150700.3.18.1","php8-sysvsem":"8.3.33-150700.3.18.1","php8":"8.3.33-150700.3.18.1","php8-bcmath":"8.3.33-150700.3.18.1","php8-iconv":"8.3.33-150700.3.18.1","php8-gmp":"8.3.33-150700.3.18.1","php8-xmlreader":"8.3.33-150700.3.18.1","php8-fpm":"8.3.33-150700.3.18.1","php8-zlib":"8.3.33-150700.3.18.1","php8-pgsql":"8.3.33-150700.3.18.1","php8-gettext":"8.3.33-150700.3.18.1","php8-sodium":"8.3.33-150700.3.18.1","php8-dba":"8.3.33-150700.3.18.1","php8-ldap":"8.3.33-150700.3.18.1","php8-fileinfo":"8.3.33-150700.3.18.1","php8-mysql":"8.3.33-150700.3.18.1","php8-exif":"8.3.33-150700.3.18.1","php8-zip":"8.3.33-150700.3.18.1","php8-intl":"8.3.33-150700.3.18.1","php8-fastcgi":"8.3.33-150700.3.18.1","php8-sockets":"8.3.33-150700.3.18.1","php8-tidy":"8.3.33-150700.3.18.1","php8-devel":"8.3.33-150700.3.18.1","php8-calendar":"8.3.33-150700.3.18.1","php8-soap":"8.3.33-150700.3.18.1","php8-tokenizer":"8.3.33-150700.3.18.1","php8-cli":"8.3.33-150700.3.18.1","php8-enchant":"8.3.33-150700.3.18.1","php8-sysvmsg":"8.3.33-150700.3.18.1","php8-pcntl":"8.3.33-150700.3.18.1","php8-odbc":"8.3.33-150700.3.18.1","php8-dom":"8.3.33-150700.3.18.1","php8-ctype":"8.3.33-150700.3.18.1","apache2-mod_php8":"8.3.33-150700.3.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3509-1.json"}},{"package":{"name":"php8-fpm","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","purl":"pkg:rpm/suse/php8-fpm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.33-150700.3.18.1"}]}],"ecosystem_specific":{"binaries":[{"php8-openssl":"8.3.33-150700.3.18.1","php8-cli":"8.3.33-150700.3.18.1","php8-pcntl":"8.3.33-150700.3.18.1","php8-zlib":"8.3.33-150700.3.18.1","php8-mbstring":"8.3.33-150700.3.18.1","php8-xmlwriter":"8.3.33-150700.3.18.1","php8-ldap":"8.3.33-150700.3.18.1","php8-curl":"8.3.33-150700.3.18.1","php8-fastcgi":"8.3.33-150700.3.18.1","apache2-mod_php8":"8.3.33-150700.3.18.1","php8-odbc":"8.3.33-150700.3.18.1","php8-phar":"8.3.33-150700.3.18.1","php8-intl":"8.3.33-150700.3.18.1","php8-pdo":"8.3.33-150700.3.18.1","php8-soap":"8.3.33-150700.3.18.1","php8-bz2":"8.3.33-150700.3.18.1","php8-gettext":"8.3.33-150700.3.18.1","php8-sodium":"8.3.33-150700.3.18.1","php8-posix":"8.3.33-150700.3.18.1","php8-dom":"8.3.33-150700.3.18.1","php8-snmp":"8.3.33-150700.3.18.1","php8-embed":"8.3.33-150700.3.18.1","php8-sqlite":"8.3.33-150700.3.18.1","php8-sysvsem":"8.3.33-150700.3.18.1","php8-mysql":"8.3.33-150700.3.18.1","php8-gmp":"8.3.33-150700.3.18.1","php8-calendar":"8.3.33-150700.3.18.1","php8-xmlreader":"8.3.33-150700.3.18.1","php8-fpm":"8.3.33-150700.3.18.1","php8-sockets":"8.3.33-150700.3.18.1","php8-test":"8.3.33-150700.3.18.1","php8":"8.3.33-150700.3.18.1","php8-tokenizer":"8.3.33-150700.3.18.1","php8-devel":"8.3.33-150700.3.18.1","php8-iconv":"8.3.33-150700.3.18.1","php8-pgsql":"8.3.33-150700.3.18.1","php8-xsl":"8.3.33-150700.3.18.1","php8-shmop":"8.3.33-150700.3.18.1","php8-dba":"8.3.33-150700.3.18.1","php8-sysvshm":"8.3.33-150700.3.18.1","php8-ctype":"8.3.33-150700.3.18.1","php8-zip":"8.3.33-150700.3.18.1","php8-tidy":"8.3.33-150700.3.18.1","php8-fileinfo":"8.3.33-150700.3.18.1","php8-readline":"8.3.33-150700.3.18.1","php8-exif":"8.3.33-150700.3.18.1","php8-gd":"8.3.33-150700.3.18.1","php8-enchant":"8.3.33-150700.3.18.1","php8-ftp":"8.3.33-150700.3.18.1","php8-sysvmsg":"8.3.33-150700.3.18.1","php8-bcmath":"8.3.33-150700.3.18.1","php8-opcache":"8.3.33-150700.3.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3509-1.json"}},{"package":{"name":"php8-test","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","purl":"pkg:rpm/suse/php8-test&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.33-150700.3.18.1"}]}],"ecosystem_specific":{"binaries":[{"php8-xsl":"8.3.33-150700.3.18.1","php8-openssl":"8.3.33-150700.3.18.1","php8-gmp":"8.3.33-150700.3.18.1","php8-pcntl":"8.3.33-150700.3.18.1","php8-xmlreader":"8.3.33-150700.3.18.1","php8-intl":"8.3.33-150700.3.18.1","php8-gettext":"8.3.33-150700.3.18.1","php8-devel":"8.3.33-150700.3.18.1","php8-embed":"8.3.33-150700.3.18.1","php8-bcmath":"8.3.33-150700.3.18.1","php8-calendar":"8.3.33-150700.3.18.1","php8-gd":"8.3.33-150700.3.18.1","php8-fpm":"8.3.33-150700.3.18.1","php8-curl":"8.3.33-150700.3.18.1","php8-sysvsem":"8.3.33-150700.3.18.1","php8-snmp":"8.3.33-150700.3.18.1","php8-sqlite":"8.3.33-150700.3.18.1","php8-mbstring":"8.3.33-150700.3.18.1","php8-tidy":"8.3.33-150700.3.18.1","php8-sodium":"8.3.33-150700.3.18.1","php8-opcache":"8.3.33-150700.3.18.1","php8-zlib":"8.3.33-150700.3.18.1","php8-readline":"8.3.33-150700.3.18.1","php8-ftp":"8.3.33-150700.3.18.1","php8-sysvshm":"8.3.33-150700.3.18.1","php8-ldap":"8.3.33-150700.3.18.1","php8-pdo":"8.3.33-150700.3.18.1","php8-iconv":"8.3.33-150700.3.18.1","php8-soap":"8.3.33-150700.3.18.1","php8-dom":"8.3.33-150700.3.18.1","php8-fastcgi":"8.3.33-150700.3.18.1","php8-enchant":"8.3.33-150700.3.18.1","php8-test":"8.3.33-150700.3.18.1","php8-sysvmsg":"8.3.33-150700.3.18.1","php8-mysql":"8.3.33-150700.3.18.1","php8-shmop":"8.3.33-150700.3.18.1","php8-zip":"8.3.33-150700.3.18.1","php8-odbc":"8.3.33-150700.3.18.1","php8-phar":"8.3.33-150700.3.18.1","php8-bz2":"8.3.33-150700.3.18.1","php8-pgsql":"8.3.33-150700.3.18.1","php8-dba":"8.3.33-150700.3.18.1","php8":"8.3.33-150700.3.18.1","php8-fileinfo":"8.3.33-150700.3.18.1","php8-posix":"8.3.33-150700.3.18.1","php8-sockets":"8.3.33-150700.3.18.1","php8-tokenizer":"8.3.33-150700.3.18.1","php8-xmlwriter":"8.3.33-150700.3.18.1","php8-cli":"8.3.33-150700.3.18.1","apache2-mod_php8":"8.3.33-150700.3.18.1","php8-exif":"8.3.33-150700.3.18.1","php8-ctype":"8.3.33-150700.3.18.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3509-1.json"}}],"schema_version":"1.8.0"}