FEDORA-2023-984c26961f
Packages in this update:
php-8.2.9-2.fc38
Update description:
PHP version 8.2.9 (03 Aug 2023)
Build:
Fixed bug GH-11522 (PHP version check fails with ‘-‘ separator). (SVGAnimate)
CLI:
Fix interrupted CLI output causing the process to exit. (nielsdos)
Core:
Fixed oss-fuzz php#60011 (Mis-compilation of by-reference nullsafe operator). (ilutov)
Fixed line number of JMP instruction over else block. (ilutov)
Fixed use-of-uninitialized-value with ??= on assert. (ilutov)
Fixed oss-fuzz php#60411 (Fix double-compilation of arrow-functions). (ilutov)
Fixed build for FreeBSD before the 11.0 releases. (David Carlier)
Curl:
Fix crash when an invalid callback function is passed to CURLMOPT_PUSHFUNCTION. (nielsdos)
Date:
Fixed bug GH-11368 (Date modify returns invalid datetime). (Derick)
Fixed bug GH-11600 (Can’t parse time strings which include (narrow) non-breaking space characters). (Derick)
Fixed bug GH-11854 (DateTime:createFromFormat stopped parsing datetime with extra space). (nielsdos, Derick)
DOM:
Fixed bug GH-11625 (DOMElement::replaceWith() doesn’t replace node with DOMDocumentFragment but just deletes node or causes wrapping <> depending on libxml2 version). (nielsdos)
Fileinfo:
Fixed bug GH-11298 (finfo returns wrong mime type for xz files). (Anatol)
FTP:
Fix context option check for “overwrite”. (JonasQuinten)
Fixed bug GH-10562 (Memory leak and invalid state with consecutive ftp_nb_fget). (nielsdos)
GD:
Fix most of the external libgd test failures. (Michael Orlitzky)
Intl:
Fix memory leak in MessageFormatter::format() on failure. (Girgias)
Libxml:
Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823) (nielsdos, ilutov)
MBString:
Fix GH-11300 (license issue: restricted unicode license headers). (nielsdos)
Opcache:
Fixed bug GH-10914 (OPCache with Enum and Callback functions results in segmentation fault). (nielsdos)
Prevent potential deadlock if accelerated globals cannot be allocated. (nielsdos)
PCNTL:
Fixed bug GH-11498 (SIGCHLD is not always returned from proc_open). (nielsdos)
PDO:
Fix GH-11587 (After php8.1, when PDO::ATTR_EMULATE_PREPARES is true and PDO::ATTR_STRINGIFY_FETCHES is true, decimal zeros are no longer filled). (SakiTakamachi)
PDO SQLite:
Fix GH-11492 (Make test failure: ext/pdo_sqlite/tests/bug_42589.phpt). (KapitanOczywisty, CViniciusSDias)
Phar:
Add missing check on EVP_VerifyUpdate() in phar util. (nielsdos)
Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824) (nielsdos)
PHPDBG:
Fixed bug GH-9669 (phpdbg -h options doesn’t list the -z option). (adsr)
Session:
Removed broken url support for transferring session ID. (ilutov)
Standard:
Fix serialization of RC1 objects appearing in object graph twice. (ilutov) Streams:
Fixed bug GH-11735 (Use-after-free when unregistering user stream wrapper from itself). (ilutov)
SQLite3:
Fix replaced error handling in SQLite3Stmt::__construct. (nielsdos)
XMLReader:
Fix GH-11548 (Argument corruption when calling XMLReader::open or XMLReader::XML non-statically with observer active). (Bob)
More Stories
USN-7169-5: Linux kernel (Real-time) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This...
stb-0^20241002git31707d1-4.el9
FEDORA-EPEL-2025-75d8605b8c Packages in this update: stb-0^20241002git31707d1-4.el9 Update description: Add another patch for the root cause of CVE-2021-45340. We already have...
stb-0^20241002git31707d1-5.el10_0
FEDORA-EPEL-2025-93a1152ae1 Packages in this update: stb-0^20241002git31707d1-5.el10_0 Update description: Add another patch for the root cause of CVE-2021-45340. We already have...
stb-0^20241002git31707d1-4.fc40
FEDORA-2025-49e8952aab Packages in this update: stb-0^20241002git31707d1-4.fc40 Update description: Add another patch for the root cause of CVE-2021-45340. We already have...
ZDI-25-026: Mintty Path Conversion Improper Input Validation Information Disclosure Vulnerability
This vulnerability allows remote attackers to relay NTLM credentials on affected installations of Mintty. User interaction is required to exploit...
Ivanti Connect Secure Zero-Day Vulnerability
What are the Vulnerabilities?Ivanti disclosed two vulnerabilities, CVE-2025-0282 and CVE-2025-0283, impacting Ivanti Connect Secure (“ICS”) VPN appliances. CVE-2025-0282 is an...