SUSE-SU-2026:3509-1: Security update for php8
This update for php8 fixes the following issues: Update to version 8.3.33.
Security issues fixed:
- CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion (bsc#1273077). - CVE-2026-9672: security issues in libgd (bsc#1273078). - CVE-2026-17543: improper escaping of backslashes in user-provided parameters allows for trivial SQL injection in ext-pgsql (bsc#1273075). - CVE-2026-17544: php: Out-of-bounds write in bccomp() via crafted operand and scale (bsc#1273076)
Other sources
This update for php8 fixes the following issues: Update to version 8.3.33. Security issues fixed: CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion (bsc#1273077). CVE-2026-9672: security issues in libgd (bsc#1273078). CVE-2026-17543: improper escaping of backslashes in user-provided parameters allows for trivial SQL injection in ext-pgsql (bsc#1273075).
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/apache2-mod_php8to a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8to a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-embedto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-fastcgito a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-fpmto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-testto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-exif-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-fpm-debugsourceto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-dom-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-curl-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-iconv-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-sockets-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-enchant-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-gd-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-ftp-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-pgsql-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-ctypeto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-cli-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-sodium-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-xmlreaderto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-bz2-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-fileinfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-socketsto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-gdto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-bcmath-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-fastcgi-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-ctype-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-gmpto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-sysvsemto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-sysvshmto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-shmopto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-sodiumto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-xmlwriterto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-xmlreader-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-pdoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-ldap-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-zlib-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-fpm-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-soap-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-snmpto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-zlibto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-pharto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-gmp-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-pgsqlto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-gettextto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-pcntl-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-clito a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-pdo-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-tokenizerto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-tidyto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-curlto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-posix-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-opcache-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-ldapto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-pcntlto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-mysqlto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-readlineto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-odbc-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-shmop-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-phar-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-openssl-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-bcmathto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-iconvto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-sysvmsgto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-snmp-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-opcacheto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-zip-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-opensslto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-soapto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-fileinfo-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-calendarto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-xsl-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-bz2to a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-dbato a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-dba-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-posixto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-enchantto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-intlto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-odbcto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-sysvshm-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-sqlite-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-mbstring-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-exifto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-mbstringto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-tokenizer-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-debugsourceto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-sqliteto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-domto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-embed-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-ftpto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-intl-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-fastcgi-debugsourceto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-develto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-xslto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-sysvmsg-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-calendar-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-tidy-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-xmlwriter-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-zipto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-sysvsem-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-mysql-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-readline-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-embed-debugsourceto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
suse/php8-gettext-debuginfoto a version that resolves this vulnerability.Fixed in 8.3.33-150700.3.18.1 - Upgrade
Upgrade
php8to a version that resolves this vulnerability.Fixed in 8.3.33Patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-3509=1
Event History
Child vulnerabilities
Contains the following vulnerabilities.