[El-errata] ELSA-2026-87080 Important: Oracle Linux 8 php:7.4 security update
Errata Announcements for Oracle Linux
el-errata at oss.oracle.com
Thu Oct 22 14:22:08 UTC 2026
Oracle Linux Security Advisory ELSA-2026-87080
http://linux.oracle.com/errata/ELSA-2026-87080.html
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:
x86_64:
apcu-panel-5.1.18-1.module+el8.10.0+90472+f810484b.noarch.rpm
libzip-1.6.1-1.module+el8.10.0+90472+f810484b.x86_64.rpm
libzip-devel-1.6.1-1.module+el8.10.0+90472+f810484b.x86_64.rpm
libzip-tools-1.6.1-1.module+el8.10.0+90472+f810484b.x86_64.rpm
php-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-bcmath-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-cli-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-common-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-dba-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-dbg-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-devel-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-embedded-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-enchant-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-ffi-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-fpm-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-gd-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-gmp-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-intl-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-json-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-ldap-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-mbstring-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-mysqlnd-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-odbc-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-opcache-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-pdo-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-pear-1.10.13-1.module+el8.10.0+90472+f810484b.noarch.rpm
php-pecl-apcu-5.1.18-1.module+el8.10.0+90472+f810484b.x86_64.rpm
php-pecl-apcu-devel-5.1.18-1.module+el8.10.0+90472+f810484b.x86_64.rpm
php-pecl-rrd-2.0.1-1.module+el8.10.0+90472+f810484b.x86_64.rpm
php-pecl-xdebug-2.9.5-1.module+el8.10.0+90472+f810484b.x86_64.rpm
php-pecl-zip-1.18.2-1.module+el8.10.0+90472+f810484b.x86_64.rpm
php-pgsql-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-process-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-snmp-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-soap-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-xml-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
php-xmlrpc-7.4.33-8.module+el8.10.0+91080+9785160d.x86_64.rpm
aarch64:
apcu-panel-5.1.18-1.module+el8.10.0+90472+f810484b.noarch.rpm
libzip-1.6.1-1.module+el8.10.0+90472+f810484b.aarch64.rpm
libzip-devel-1.6.1-1.module+el8.10.0+90472+f810484b.aarch64.rpm
libzip-tools-1.6.1-1.module+el8.10.0+90472+f810484b.aarch64.rpm
php-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-bcmath-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-cli-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-common-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-dba-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-dbg-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-devel-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-embedded-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-enchant-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-ffi-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-fpm-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-gd-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-gmp-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-intl-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-json-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-ldap-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-mbstring-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-mysqlnd-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-odbc-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-opcache-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-pdo-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-pear-1.10.13-1.module+el8.10.0+90472+f810484b.noarch.rpm
php-pecl-apcu-5.1.18-1.module+el8.10.0+90472+f810484b.aarch64.rpm
php-pecl-apcu-devel-5.1.18-1.module+el8.10.0+90472+f810484b.aarch64.rpm
php-pecl-rrd-2.0.1-1.module+el8.10.0+90472+f810484b.aarch64.rpm
php-pecl-xdebug-2.9.5-1.module+el8.10.0+90472+f810484b.aarch64.rpm
php-pecl-zip-1.18.2-1.module+el8.10.0+90472+f810484b.aarch64.rpm
php-pgsql-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-process-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-snmp-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-soap-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-xml-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
php-xmlrpc-7.4.33-8.module+el8.10.0+91080+9785160d.aarch64.rpm
SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/libzip-1.6.1-1.module+el8.10.0+90472+f810484b.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/php-7.4.33-8.module+el8.10.0+91080+9785160d.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/php-pear-1.10.13-1.module+el8.10.0+90472+f810484b.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/php-pecl-apcu-5.1.18-1.module+el8.10.0+90472+f810484b.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/php-pecl-rrd-2.0.1-1.module+el8.10.0+90472+f810484b.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/php-pecl-xdebug-2.9.5-1.module+el8.10.0+90472+f810484b.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/php-pecl-zip-1.18.2-1.module+el8.10.0+90472+f810484b.src.rpm
Related CVEs:
CVE-2025-1218
CVE-2025-14181
CVE-2026-6103
CVE-2026-91765
CVE-2026-91766
CVE-2026-91767
CVE-2026-91768
CVE-2026-91769
CVE-2026-92842
CVE-2026-93682
CVE-2026-109618
CVE-2026-109619
Description of changes:
libzip
[1.6.1-1]
- update to 1.6.1
- enable lzma support
[1.5.2-1]
- update to 1.5.2
- add all explicit cmake options to ensure openssl is used
even in local build with other lilbraries available
[1.5.1-1]
- update to 1.5.1
- drop dependency on zlib-devel and bzip2-devel no more
referenced in libzip.pc
- drop rpath patch merged upstream
[1.5.0-2]
- add dependency on zlib-devel and bzip2-devel #1556068
[1.5.0-1]
- update to 1.5.0
- use openssl for cryptography instead of bundled custom AES implementation
[1.4.0-5]
- missing BR on C compiler
- use ldconfig_scriptlets
[1.4.0-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
[1.4.0-3]
- add upstream patch and drop multilib hack
[1.4.0-2]
- re-add multilib hack #1529886
[1.4.0-1]
- update to 1.4.0
- switch to cmake
- add upstream patch for lib64
php
[7.4.33-8]
- Avoid state corruption via bailout
CVE-2026-109618, CVE-2026-109619
[7.4.33-7]
- Fix FILTER_SANITIZE_ENCODED does not encode 0xFF
- Fix IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison
CVE-2026-91768
- Fixed Various packet overreads in mysqlnd wire protocol
CVE-2025-1218
- Fix TLS hostname verification falls back to CN after SAN mismatch
CVE-2026-91769
- Fix Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN
CVE-2026-91767
- Fix Integer overflow in phar_tar_number() allowing TAR archive entry injection
CVE-2026-6103
- Fix Unbounded recursion in server-side cleanup_xml_node()
CVE-2026-91765
- Fix Integer overflow to buffer overflow in SOAP HTTP parsing
CVE-2025-14181
- Fix Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL
CVE-2026-92842
- Fix Cross-origin credential leak in HTTP stream wrapper redirects
CVE-2026-91766
- Fix Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
CVE-2026-93682
[7.4.33-6]
- Fix leak on double DatePeriod::__construct() call
- Fixed SQL injection via E'...' backslash breakout
CVE-2026-17543
- Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks
CVE-2026-7260
[7.4.33-5]
- Fix Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
CVE-2026-14355
[7.4.33-4]
- Fix XSS within status endpoint
CVE-2026-6735
- Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map
CVE-2026-6722
- Fix Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION
CVE-2026-7261
- Fix Broken Apache map value NULL check
CVE-2026-7262
- Fix Signed integer overflow of char array offset
CVE-2026-7568
- Fix Consistently pass unsigned char to ctype.h functions
CVE-2026-7258
[7.4.33-3]
- Fix Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface
GHSA-4w77-75f9-2c8w
- Fix Configuring a proxy in a stream context might allow for CRLF injection in URIs
CVE-2024-11234
- Fix Single byte overread with convert.quoted-printable-decode filter
CVE-2024-11233
- Fix Leak partial content of the heap through heap buffer over-read
CVE-2024-8929
- Fix libxml streams use wrong content-type header when requesting a redirected resource
CVE-2025-1219
- Fix Stream HTTP wrapper header check might omit basic auth header
CVE-2025-1736
- Fix Stream HTTP wrapper truncate redirect location to 1024 bytes
CVE-2025-1861
- Fix Streams HTTP wrapper does not fail for headers without colon
CVE-2025-1734
- Fix Header parser of http stream wrapper does not handle folded headers
CVE-2025-1217
- Fix pgsql extension does not check for errors during escaping
CVE-2025-1735
- Fix NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
CVE-2025-6491
- Fix Null byte termination in hostnames
CVE-2025-1220
- Fix Null byte termination in dns_get_record()
GHSA-www2-q4fc-65wf
- Fix Heap buffer overflow in array_merge()
CVE-2025-14178
- Fix Information Leak of Memory in getimagesize
CVE-2025-14177
[7.4.33-2]
- fix low/moderate CVEs
RHEL-66589
- Fix cgi.force_redirect configuration is bypassable due to the environment variable collision
CVE-2024-8927
- Fix Logs from childrens may be altered
CVE-2024-9026
- Fix Erroneous parsing of multipart form data
CVE-2024-8925
- Fix filter bypass in filter_var FILTER_VALIDATE_URL
CVE-2024-5458
- Fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
CVE-2024-2756
- Fix password_verify can erroneously return true opening ATO risk
CVE-2024-3096
- Fix Security issue with external entity loading in XML without enabling it
CVE-2023-3823
- Fix Buffer mismanagement in phar_dir_read()
CVE-2023-3824
- Fix Missing error check and insufficient random bytes in HTTP Digest
authentication for SOAP
CVE-2023-3247
- fix #81744: Password_verify() always return true with some hash
CVE-2023-0567
- fix #81746: 1-byte array overrun in common path resolve code
CVE-2023-0568
- fix DOS vulnerability when parsing multipart request body
CVE-2023-0662
[7.4.33-1]
- rebase to 7.4.33
- fix: due to an integer overflow PDO::quote() may return unquoted string
CVE-2022-31631
[7.4.30-1]
- rebase to 7.4.30 #2099615
[7.4.19-3]
- fix password of excessive length triggers buffer overflow leading to RCE
CVE-2022-31626
php-pear
[1:1.10.13-1]
- update PEAR to 1.10.13
- update Archive_Tar to 1.4.14
[1:1.10.12-1]
- update PEAR to 1.10.12
- update Archive_Tar to 1.4.9
- update Console_Getopt to 1.4.3
- update XML_Util to 1.4.5
[1:1.10.9-1]
- update PEAR to 1.10.9
- update Archive_Tar to 1.4.7
- update Console_Getopt to 1.4.2
[1:1.10.5-8]
- require /usr/bin/gpg instead of gnupg
[1:1.10.5-7]
- enable autoloader only in Fedora
[1:1.10.5-6]
- add patch for PHP 7.2 from
https://github.com/pear/pear-core/pull/71
[1:1.10.5-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
[1:1.10.5-4]
- add autoloader for each package
[1:1.10.5-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
[1:1.10.5-2]
- update XML_Util to 1.4.3 (no change)
php-pecl-apcu
[5.1.18-1]
- update to 5.1.18
[5.1.17-1]
- update to 5.1.17
[5.1.12-1]
- update to 5.1.12 (stable)
[5.1.11-1]
- update to 5.1.11 (stable)
[5.1.10-1]
- update to 5.1.10 (stable)
[5.1.9-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
[5.1.9-2]
- undefine _strict_symbol_defs_build
[5.1.9-1]
- Update to 5.1.9 (php 7, stable)
[5.1.8-5]
- rebuild for https://fedoraproject.org/wiki/Changes/php72
[5.1.8-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
php-pecl-rrd
[2.0.1-1]
- build for RHEL 8
[2.0.1-13]
- rebuild for https://fedoraproject.org/wiki/Changes/php74
[2.0.1-12]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
[2.0.1-11]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
[2.0.1-10]
- Rebuild for https://fedoraproject.org/wiki/Changes/php73
[2.0.1-9]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
[2.0.1-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
[2.0.1-7]
- undefine _strict_symbol_defs_build
[2.0.1-6]
- rebuild for https://fedoraproject.org/wiki/Changes/php72
[2.0.1-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
php-pecl-xdebug
[2.9.5-1]
- update to 2.9.5
[2.8.0-1]
- build for RHEL 8 #1769857
[2.8.0-1]
- update to 2.8.0
[2.7.2-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
[2.7.2-1]
- update to 2.7.2
[2.7.1-1]
- update to 2.7.1
[2.7.0-1]
- update to 2.7.0 (stable)
[2.7.0-0.3.RC2]
- update to 2.7.0RC2
[2.7.0-0.2.rc1]
- update to 2.7.0RC1
[2.7.0-0.1.beta1.1]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
php-pecl-zip
[1.18.2-1]
- update to 1.18.2
[1.15.4-1]
- Update to 1.15.4
[1.15.3-1]
- Update to 1.15.3
[1.15.2-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
[1.15.2-2]
- undefine _strict_symbol_defs_build
[1.15.2-1]
- Update to 1.15.2
[1.15.1-4]
- rebuild for https://fedoraproject.org/wiki/Changes/php72
[1.15.1-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
[1.15.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
[1.15.1-1]
- Update to 1.15.1
More information about the El-errata
mailing list