-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 04 Oct 2026 16:03:09 +0200
Source: php8.2
Architecture: source
Version: 8.2.34-1~deb12u1
Distribution: bookworm-security
Urgency: high
Maintainer: Debian PHP Maintainers <team+pkg-php@tracker.debian.org>
Changed-By: Guilhem Moulin <guilhem@debian.org>
Changes:
php8.2 (8.2.34-1~deb12u1) bookworm-security; urgency=high
.
* Non-maintainer upload by the LTS Team.
* New upstream version 8.2.34:
+ [MySQLnd] Fix CVE-2025-1218: Various packet overreads in mysqlnd wire
protocol.
+ [SOAP] Fix CVE-2025-14181: Integer overflow to buffer overflow in SOAP
HTTP parsing.
+ [Phar] Fix CVE-2026-6103: Phar TAR phar_tar_number() Integer Overflow
allowing Archive Entry Injection.
+ [SOAP] Fix CVE-2026-91765: Unbounded recursion in server-side
cleanup_xml_node().
+ Fix CVE-2026-91766: Cross-origin credential leak in HTTP stream wrapper
redirects.
+ [OpenSSL] Fix CVE-2026-91767: Heap-buffer-overflow in
php_openssl_matches_wildcard_name() on crafted server cert wildcard CN.
+ [FPM] Fix CVE-2026-91768: IPv6 ACL bypass in FastCGI
listen.allowed_clients due to partial address comparison.
+ [OpenSSL] Fix CVE-2026-91769: TLS hostname verification falls back to CN
after SAN Mismatch.
+ Fix CVE-2026-92842: OOB read / info leak in convert.* stream filters
when line-break-chars contains NUL.
+ Fix CVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when
following a redirect with an empty Location header.
+ [Filter] Fix Encode 0xFF in FILTER_SANITIZE_ENCODED.
* Refresh d/patches.
Checksums-Sha1:
6a026ea79b819622120c5f07a43a4a324fa67dcf 5596 php8.2_8.2.34-1~deb12u1.dsc
a86d2588ebc15a8538726f7dfd246c0facd66fae 12174884 php8.2_8.2.34.orig.tar.xz
c089209ccc6e10b74c3c3bc572c10995a677a468 858 php8.2_8.2.34.orig.tar.xz.asc
a48e5c61fb2a75b6bda82a0c7fcc553c481e3554 71692 php8.2_8.2.34-1~deb12u1.debian.tar.xz
fc7eac803cd2a0a34b262f5b640001da42e87723 7831 php8.2_8.2.34-1~deb12u1_source.buildinfo
Checksums-Sha256:
814d54630f49b84cbf951d2cff79e0d6ad48b5be367f20cde97a79166210c102 5596 php8.2_8.2.34-1~deb12u1.dsc
5351330c54de240f54f7527c26ef292e239749e6fe11db0330acb5317e02bb39 12174884 php8.2_8.2.34.orig.tar.xz
3d21b026166a703a797b83301d833b9ba16ee315faecc81c40327eb5a81bde5b 858 php8.2_8.2.34.orig.tar.xz.asc
6c72c693b4e99f060542f268d3e564b84316b6d88ec9caf4964fdd47d78b0dca 71692 php8.2_8.2.34-1~deb12u1.debian.tar.xz
b6cbd44b8afa6513852922dc27ec238a8e5032bc8678de38d6c8ca3ed61d3894 7831 php8.2_8.2.34-1~deb12u1_source.buildinfo
Files:
e761841249b6edd8c9c4873fa1cc36c3 5596 php optional php8.2_8.2.34-1~deb12u1.dsc
568f00e36ae9f987bb235c4ab6049042 12174884 php optional php8.2_8.2.34.orig.tar.xz
e65f197f27674807a9e96acf96dbfae7 858 php optional php8.2_8.2.34.orig.tar.xz.asc
4bedf46eab21774bd94b231c0b61e8d4 71692 php optional php8.2_8.2.34-1~deb12u1.debian.tar.xz
1a17ebf9e56ece0d28da7d9c56a7499e 7831 php optional php8.2_8.2.34-1~deb12u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrCr6AACgkQ05pJnDwh
pVJbZQ/9FXf8o/20ZG1aWLDNxluUUhmtFsQKjN+LZHjFLsbYDgoGwh4caZwInYos
B2qrJ+8DzaM/53wWllGOvOsvMLJ48AF+CjVQsx6K3jxtoZ5jI8EbStJo+G83hWcp
S8Ox5+Hler+LoU8O5inOKjLRTzz3QEVhl6AptuihvA655hvRWRO3NK0rg2B8hly1
/SZQwPj6meezIvWyQwzpAH/sN7GFUICOiNXHtpBcFZMAqzLqHbZn8ExVsTwOQcSt
MluP0EMglNI21IHq/9ipa3eMgNhEssr5dROTq6VuXndGKEUTDs3O0lbpD0WnCEvd
22Pg9Bk2/7qSf14bbMa7dT+ZBguWZT+Q1Xsk2xTYge3Ig+B40ITfJlEbGgd8vdzj
7Ihm8wR+YMp2Y0H2WLwFBRsOJv0CVi4bqatmgwQ3TZij45LGlt+edYZOWgs6Liig
MZhNQFsVD5V2MtbqgbluLH330gh7l0LkZ7wMy9e6mW45yenX5ZmmNoYRfrAHemzQ
XrwutlXJythivfIjjrn1t6I1Ky4jgPgByiVRp1kmwHFOdSoH1r0FKcz79KFsyECm
/8OR75eglfWihBZI3/00fPrjBlWoS+m889Mr8l1BzpRl//sEwFCthVTF8XHEfblj
dUKj9/vgI7C9swSrN1ku0Miyr2Wz8vj+eDghU7FX2tzGdRLn4ZQ=
=NOb+
-----END PGP SIGNATURE-----
