From fea2058e67e90dab8a7366fbde98941a3b61bf33 Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@remirepo.net>
Date: Wed, 13 May 2026 13:19:31 +0200
Subject: Fix XSS within status endpoint

  CVE-2026-6735
Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map
  CVE-2026-6722
Fix Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION
  CVE-2026-7261
Fix Broken Apache map value NULL check
  CVE-2026-7262
Fix Signed integer overflow of char array offset
  CVE-2026-7568
---
 php73.spec | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

(limited to 'php73.spec')

diff --git a/php73.spec b/php73.spec
index bd4ae8f..e7429e2 100644
--- a/php73.spec
+++ b/php73.spec
@@ -117,7 +117,7 @@
 Summary: PHP scripting language for creating dynamic web sites
 Name: php
 Version: %{upver}%{?rcver:~%{rcver}}
-Release: 19%{?dist}
+Release: 20%{?dist}
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
 # TSRM is licensed under BSD
@@ -215,6 +215,11 @@ Patch221: php-cve-2024-11233.patch
 Patch222: php-ghsa-4w77-75f9-2c8w.patch
 Patch223: php-cve-2024-8929.patch
 Patch224: php-cve-2025-14178.patch
+Patch225: php-cve-2026-6722.patch
+Patch226: php-cve-2026-7261.patch
+Patch227: php-cve-2026-7262.patch
+Patch228: php-cve-2026-6735.patch
+Patch229: php-cve-2026-7568.patch
 
 # Fixes for tests (300+)
 # Factory is droped from system tzdata
@@ -1221,6 +1226,11 @@ low-level PHP extension for the libsodium cryptographic library.
 %patch -P222 -p1 -b .ghsa4w77
 %patch -P223 -p1 -b .cve8929
 %patch -P224 -p1 -b .cve14178
+%patch -P225 -p1 -b .cve6722
+%patch -P226 -p1 -b .cve7261
+%patch -P227 -p1 -b .cve7262
+%patch -P228 -p1 -b .cve6735
+%patch -P229 -p1 -b .cve7268
 
 # Fixes for tests
 %if 0%{?fedora} >= 25 || 0%{?rhel} >= 6
@@ -2315,6 +2325,18 @@ EOF
 
 
 %changelog
+* Tue May 12 2026 Remi Collet <remi@remirepo.net> - 7.3.33-20
+- Fix XSS within status endpoint
+  CVE-2026-6735
+- Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map
+  CVE-2026-6722
+- Fix Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION
+  CVE-2026-7261
+- Fix Broken Apache map value NULL check
+  CVE-2026-7262
+- Fix Signed integer overflow of char array offset
+  CVE-2026-7568
+
 * Tue Feb 17 2026 Remi Collet <remi@remirepo.net> - 7.3.33-19
 - Fix Heap buffer overflow in array_merge()
   CVE-2025-14178
-- 
cgit