diff options
Diffstat (limited to 'php.spec')
| -rw-r--r-- | php.spec | 51 |
1 files changed, 49 insertions, 2 deletions
@@ -49,7 +49,7 @@ %global mysql_sock %(mysql_config --socket 2>/dev/null || echo /var/lib/mysql/mysql.sock) -%global oraclever 23.9 +%global oraclever 23.26.1 %global oraclemax 24 %global oraclelib 23.1 %global oracledir 23 @@ -133,7 +133,7 @@ Summary: PHP scripting language for creating dynamic web sites Name: %{?scl_prefix}php Version: %{upver}%{?rcver:~%{rcver}}%{?gh_date:.%{gh_date}} -Release: 1%{?dist} +Release: 2%{?dist} # All files licensed under PHP version 3.01, except # Zend is licensed under Zend # TSRM is licensed under BSD @@ -198,6 +198,14 @@ Patch91: php-7.2.0-oci8conf.patch # Upstream fixes (100+) # Security fixes (200+) +Patch200: php-cve-2026-14179.patch +Patch201: php-cve-2026-6722.patch +Patch202: php-cve-2026-7261.patch +Patch203: php-cve-2026-7262.patch +Patch204: php-cve-2026-6735.patch +Patch205: php-cve-2026-7259.patch +Patch206: php-cve-2026-7568.patch +Patch207: php-cve-2026-7258.patch # Fixes for tests (300+) # Factory is droped from system tzdata @@ -982,6 +990,14 @@ sed -e 's/php-devel/%{?scl_prefix}php-devel/' -i scripts/phpize.in # upstream patches # security patches +%patch -P200 -p1 -b .cve14179 +%patch -P201 -p1 -b .cve6722 +%patch -P202 -p1 -b .cve7261 +%patch -P203 -p1 -b .cve7262 +%patch -P204 -p1 -b .cve6735 +%patch -P205 -p1 -b .cve7259 +%patch -P206 -p1 -b .cve7268 +%patch -P207 -p1 -b .cve7258 # Fixes for tests %patch -P300 -p1 -b .datetests @@ -1707,6 +1723,19 @@ fi %endif +%posttrans common +cat << EOF +===================================================================== + + WARNING : PHP 8.1 have reached its "End of Life" in + December 2025. Even, if this package includes some of + the important security fixes, backported from 8.2, the + UPGRADE to a maintained version is very strongly RECOMMENDED. + +===================================================================== +EOF + + %{!?_licensedir:%global license %%doc} %files @@ -1864,6 +1893,24 @@ fi %changelog +* Thu May 7 2026 Remi Collet <remi@remirepo.net> - 8.1.34-2 +- Fix XSS within status endpoint + CVE-2026-6735 +- Fix Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() + CVE-2026-7259 +- Fix SQL injection via NUL bytes in quoted strings + CVE-2025-14179 +- Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map + CVE-2026-6722 +- Fix Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION + CVE-2026-7261 +- Fix Broken Apache map value NULL check + CVE-2026-7262 +- Fix Signed integer overflow of char array offset + CVE-2026-7568 +- Fix Consistently pass unsigned char to ctype.h functions + CVE-2026-7258 + * Wed Dec 17 2025 Remi Collet <remi@remirepo.net> - 8.1.34-1 - Update to 8.1.34 - http://www.php.net/releases/8_1_34.php |