Package "php8.3-bcmath"

php8.3 (8.3.6-0ubuntu0.24.04.13) noble-security; urgency=medium

  * SECURITY UPDATE: Remote RCE via state corruption issue
    - debian/patches/CVE-2026-109618_109619.patch: Avoid state corruption via
      bailout in Zend/tests/bug40770.phpt, Zend/tests/bug54268.phpt,
      Zend/tests/bug76846.phpt,
      Zend/tests/debug_backtrace_sensitive_named_variadic.phpt,
      Zend/tests/fibers/get-return-after-bailout.phpt, Zend/tests/gh11189.phpt,
      Zend/tests/gh11189_1.phpt,
      Zend/tests/oom_SplFixedArray___unserialize.phpt,
      Zend/tests/oom_SplFixedArray___wakeup.phpt,
      Zend/tests/oom_SplFixedArray_copy_ctor.phpt,
      Zend/tests/oom_SplFixedArray_fromArray_001.phpt,
      Zend/tests/oom_SplFixedArray_fromArray_002.phpt,
      Zend/tests/oom_after_main_script.phpt, Zend/tests/oom_array_fill_001.phpt,
      Zend/tests/oom_array_fill_002.phpt, Zend/tests/oom_array_fill_003.phpt,
      Zend/tests/oom_array_fill_004.phpt, Zend/tests/oom_array_pad_001.phpt,
      Zend/tests/oom_array_pad_002.phpt, Zend/tests/oom_array_pad_003.phpt,
      Zend/tests/oom_array_pad_004.phpt, Zend/tests/oom_array_pad_005.phpt,
      Zend/tests/oom_array_pad_006.phpt, Zend/tests/oom_array_pad_007.phpt,
      Zend/tests/oom_array_pad_008.phpt, Zend/tests/oom_call_function.phpt,
      Zend/tests/oom_call_function_002.phpt,
      Zend/tests/oom_call_function_003.phpt,
      Zend/tests/oom_debug_backtrace.phpt,
      Zend/tests/oom_debug_backtrace_args.phpt,
      Zend/tests/oom_debug_backtrace_named_args.phpt,
      Zend/tests/oom_error_get_last.phpt, Zend/tests/oom_exception_trace.phpt,
      Zend/tests/oom_hard_limit_exceeded.phpt,
      Zend/tests/oom_hard_limit_exceeded_during_complilation.phpt,
      Zend/tests/oom_interrupt.phpt,
      Zend/tests/oom_interrupt_unfinished_call_frame.phpt,
      Zend/tests/oom_interrupt_unfinished_call_frame_fiber.phpt,
      Zend/tests/oom_json_decode_001.phpt, Zend/tests/oom_json_decode_002.phpt,
      Zend/tests/oom_json_decode_003.phpt, Zend/tests/oom_json_decode_004.phpt,
      Zend/tests/oom_json_decode_005.phpt, Zend/tests/oom_json_decode_006.phpt,
      Zend/tests/oom_json_decode_007.phpt,
      Zend/tests/oom_pending_at_shutdown.phpt, Zend/tests/oom_range_001.phpt,
      Zend/tests/oom_range_002.phpt, Zend/tests/oom_range_003.phpt,
      Zend/tests/oom_range_004.phpt, Zend/tests/oom_request_parsing.phpt,
      Zend/tests/oom_soft_limit_exceeded.phpt,
      Zend/tests/oom_soft_limit_exceeded_fcall.phpt,
      Zend/tests/oom_soft_limit_in_callback.phpt,
      Zend/tests/oom_str_repeat.phpt, Zend/tests/oom_unserialize_001.phpt,
      Zend/tests/oom_unserialize_002.phpt, Zend/tests/oom_unserialize_003.phpt,
      Zend/tests/oom_unserialize_004.phpt, Zend/tests/oom_unserialize_005.phpt,
      Zend/tests/oom_unserialize_006.phpt, Zend/tests/oom_unserialize_007.phpt,
      Zend/tests/oom_unserialize_008.phpt, Zend/tests/oom_unserialize_009.phpt,
      Zend/tests/oom_unserialize_011.phpt, Zend/tests/oom_unserialize_012.phpt,
      Zend/tests/oom_unserialize_013.phpt, Zend/tests/oom_unserialize_014.phpt,
      Zend/tests/oom_unserialize_015.phpt, Zend/tests/oom_unserialize_016.phpt,
      Zend/tests/singleton_array.phpt, Zend/zend.c, Zend/zend_API.c,
      Zend/zend_API.h, Zend/zend_alloc.c, Zend/zend_alloc.h,
      Zend/zend_attributes.c, Zend/zend_attributes.h,
      Zend/zend_builtin_functions.c, Zend/zend_compile.c,
      Zend/zend_exceptions.c, Zend/zend_execute.c, Zend/zend_execute_API.c,
      Zend/zend_globals.h, Zend/zend_hash.c, Zend/zend_hash.h,
      Zend/zend_objects.c, Zend/zend_objects.h, Zend/zend_operators.c,
      Zend/zend_operators.h, Zend/zend_smart_str.c, Zend/zend_smart_str.h,
      Zend/zend_string.c, Zend/zend_string.h, Zend/zend_types.h,
      Zend/zend_vm_def.h, Zend/zend_vm_execute.h, ext/bz2/bz2.c,
      ext/bz2/bz2_filter.c, ext/bz2/tests/oom_bzcompress.phpt,
      ext/bz2/tests/oom_bzdecompress.phpt,
      ext/bz2/tests/oom_bzip2_decompress_filter.phpt, ext/curl/interface.c,
      ext/curl/tests/oom_curl_exec.phpt,
      ext/curl/tests/oom_curl_multi_exec.phpt, ext/curl/tests/responder/get.inc,
      ext/date/lib/parse_date.c, ext/date/lib/parse_date.re,
      ext/date/lib/parse_iso_intervals.c, ext/date/lib/parse_iso_intervals.re,
      ext/date/tests/oom_date_create.phpt,
      ext/date/tests/oom_date_create_immutable.phpt,
      ext/date/tests/oom_date_interval_create_from_date_string.phpt,
      ext/date/tests/oom_date_modify.phpt, ext/date/tests/oom_date_parse.phpt,
      ext/date/tests/oom_dateinterval_construct.phpt,
      ext/date/tests/oom_dateinterval_createfromdatestring.phpt,
      ext/date/tests/oom_dateperiod_construct.phpt,
      ext/date/tests/oom_datetime_construct.phpt,
      ext/date/tests/oom_datetime_modify.phpt,
      ext/date/tests/oom_datetimeimmutable_construct.phpt,
      ext/date/tests/oom_datetimeimmutable_modify.phpt,
      ext/date/tests/oom_strtotime.phpt, ext/dom/tests/oom_xpath.phpt,
      ext/dom/xpath.c, ext/exif/exif.c,
      ext/exif/tests/oom_exif_big_thumbnail.inc,
      ext/exif/tests/oom_exif_numeric_metadata.phpt,
      ext/exif/tests/oom_exif_read_data_tags.phpt,
      ext/exif/tests/oom_exif_scan_jpeg_header.phpt,
      ext/exif/tests/oom_exif_thumbnail_large_file_001.phpt,
      ext/exif/tests/oom_exif_thumbnail_large_file_002.phpt,
      ext/exif/tests/oom_exif_thumbnail_tiff.phpt, ext/fileinfo/libmagic.patch,
      ext/fileinfo/libmagic/cdf.c, ext/fileinfo/tests/oom_cdf_sector_chain.phpt,
      ext/filter/filter.c, ext/filter/sanitizing_filters.c,
      ext/filter/tests/oom_filter_default_encoded.phpt,
      ext/filter/tests/oom_filter_input.phpt,
      ext/filter/tests/oom_filter_input_array.phpt,
      ext/filter/tests/oom_filter_var.phpt,
      ext/filter/tests/oom_filter_var_array.phpt,
      ext/filter/tests/oom_filter_var_full_special_chars.phpt,
      ext/gd/libgd/gd.c, ext/gd/libgd/gd_gd2.c, ext/gd/libgd/gd_tga.c,
      ext/gd/libgd/gdhelpers.h, ext/gd/libgd/wbmp.c,
      ext/gd/t

php8.3 (8.3.6-0ubuntu0.24.04.12) noble-security; urgency=medium

  * SECURITY UPDATE: heap buffer over-read in stream filter line-break-chars option
    - debian/patches/CVE-2026-92842.patch: Fix heap-buffer-overflow in convert
      stream filters with NUL in line-break-chars in ext/standard/filters.c,
      ext/standard/tests/filters/ghsa-88hq-2827-7pg6.phpt.
    - CVE-2026-92842
  * SECURITY UPDATE: FastCGI allowed_clients only matched /96 prefix of IPv6 addresses
    - debian/patches/CVE-2026-91768.patch: Fix GHSA-62xp-839h-2637: FastCGI
      allowed_clients compared only 96 bits of IPv6 addresses in main/fastcgi.c,
      sapi/fpm/tests/ghsa-62xp-839h-2637-ipv6-allowed-clients.phpt,
      sapi/fpm/tests/ghsa-62xp-839h-2637-v4mapped-allowed-clients.phpt.
    - CVE-2026-91768
  * SECURITY UPDATE: OpenSSL peer verification incorrectly fell back to CN
    - debian/patches/CVE-2026-91769.patch: Fix GHSA-vvx9-73fr-5jjx: do not fall
      back to CN if the cert has a service ID in
      ext/openssl/tests/san_absent_cn_fallback.phpt,
      ext/openssl/tests/san_no_cn_fallback.phpt,
      ext/openssl/tests/san_peer_matching.phpt,
      ext/openssl/tests/san_srv_no_cn_fallback.phpt,
      ext/openssl/tests/san_uri_no_cn_fallback.phpt, ext/openssl/xp_ssl.c.
    - CVE-2026-91769
  * SECURITY UPDATE: OOB read in wildcard certificate name matching
    - debian/patches/CVE-2026-91767.patch: Fix GHSA-xr7j-rvgx-xq5p: OOB read in
      php_openssl_matches_wildcard_name() in ext/openssl/tests/GHSA-xr7j-rvgx-
      xq5p.phpt, ext/openssl/xp_ssl.c.
    - CVE-2026-91767
  * SECURITY UPDATE: mysqlnd wire protocol parser OOB reads on truncated packets
    - debian/patches/CVE-2025-1218.patch: Fix GHSA-r6x9-5r99-36j7: Various
      packet overreads in mysqlnd wireprotocol in
      ext/mysqli/tests/fake_server.inc,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-packet-affected-
      rows-2-bytes.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-packet-
      affected-rows-8-bytes.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-
      packet-affected-rows-null-length.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-packet-affected-rows.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-packet-last-insert-id-no-
      space.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-packet-last-insert-
      id.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-packet-warning-
      count.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-auth-switch-
      unterminated.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-cached-
      sha2-empty.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-cached-sha2-fast-
      auth.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-cached-sha2-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-cached-sha2-switch-unterminated.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-chg-user-empty.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-chg-user-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-chg-user-switch-unterminated.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-eof-warning-count.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-greet-packet-string.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-greet-packet.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-greet-scramble-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-ok-packet-affected-rows.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-ok-packet-last-insert-id.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-ok-packet-message-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-ok-packet-warning-count.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-query-row-eof-short.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-query-row-field-len-2-bytes.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-query-row-field-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-query-row-field-null.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-rset-header-field-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-rset-header-upsert-affected-
      rows.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-rset-header-upsert-
      len.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-sha256-pk-empty.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-sha256-pk-len.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-stmt-response-field-len-faulty.phpt,
      ext/mysqli/tests/ghsa-r6x9-5r99-36j7-stmt-response-field-len-
      premature.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-stmt-response-row-
      status.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-stmt-row-short-length-
      date.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-stmt-row-short-length-
      datetime.phpt, ext/mysqli/tests/ghsa-r6x9-5r99-36j7-stmt-row-short-length-
      time.phpt, ext/mysqlnd/mysqlnd_ps.c, ext/mysqlnd/mysqlnd_ps_codec.c,
      ext/mysqlnd/mysqlnd_wireprotocol.c, ext/mysqlnd/mysqlnd_wireprotocol.h.
    - CVE-2025-1218
  * SECURITY UPDATE: HTTP stream wrapper leaks credentials to cross-origin redirects
    - debian/patches/CVE-2026-91766.patch: Fix GHSA-fpwc-w8rq-cr92: strip
      credentials from user headers on cross-origin redirects in
      ext/standard/http_fopen_wrapper.c, ext/standard/tests/http/bug61548.phpt,
      ext/standard/tests/http/ghsa-fpwc-w8rq-cr92.phpt.
    - CVE-2026-91766
  * SECURITY UPDATE: unbounded recursion in SOAP XML parser allows remote DoS
    - debian/patches/CVE-2026-91765.patch: Fix GHSA-rgrp-mwpx-f6rm: unbounded
      recursion in ext/soap XML parsing and decoding in ext/soap/php_encoding.c,
      ext/soap/php_soap.h, ext/soap/php_xml.c, ext/soap/soap.c,
      ext/soap/tests/GHSA-rgrp-mwpx-f6rm-href-chain.phpt, ext/soap/tests/GHSA-
      rgrp-mwpx-f6rm-href-cycle.phpt, ext/soap/tests/GHSA-rgrp-mwpx-f6rm.phpt.
    - CVE-2026-91765
  * SECURITY UPDATE: heap buffer overflow in SOAP HTTP client response buffer
    - debian/patches/CVE-2025-14181.patch: Fix GHSA-cj93-vc83-wgqv in
      ext/soap/php_http.c, ext/soap/tests/bugs/GHSA-cj93-vc83-wgqv.phpt.
    - CVE-2025-14181
  * SECURITY UPDATE: integer overflow in phar TAR size field allows entry injection
    - debian/

php8.3 (8.3.6-0ubuntu0.24.04.11) noble-security; urgency=medium

  * SECURITY UPDATE: SQL injection via improper escaping of backslashes
    - debian/patches/CVE-2026-17543.patch: Fix SQL injection in ext-pgsql via
      E'...' backslash breakout in ext/pgsql/pgsql.c,
      ext/pgsql/tests/10pg_convert_9.phpt,
      ext/pgsql/tests/10pg_convert_json_array.phpt,
      ext/pgsql/tests/12pg_insert_9.phpt, ext/pgsql/tests/14pg_update_9.phpt,
      ext/pgsql/tests/GHSA-7qpv-r5mr-78m4.phpt, ext/pgsql/tests/bug64609.phpt,
      ext/pgsql/tests/bug68638.phpt.
    - CVE-2026-17543
  * SECURITY UPDATE: DoS via circular symbolic links in phar archives
    - debian/patches/CVE-2026-7260.patch: Fix GHSA-vc5h-9ppw-p5f3: phar circular
      symlink crash in ext/phar/util.c.
    - CVE-2026-7260

 -- Marc Deslauriers Wed, 02 Sep 2026 08:56:02 -0400

  php8.3 (8.3.6-0ubuntu0.24.04.9) noble-security; urgency=medium

  * SECURITY UPDATE: SQL injection in PDO Firebird driver
    - debian/patches/CVE-2025-14179.patch: GHSA-w476-322c-wpvm: [pdo_firebird]
      Fix SQL injection via NUL bytes in quoted strings in
      ext/pdo_firebird/firebird_driver.c,
      ext/pdo_firebird/tests/ghsa-w476-322c-wpvm.phpt.
    - CVE-2025-14179
  * SECURITY UPDATE: use-after-free in SOAP extension
    - debian/patches/CVE-2026-6722.patch: GHSA-85c2-q967-79q5: [soap] Fix stale
      SOAP_GLOBAL(ref_map) pointer with Apache Map in ext/soap/php_encoding.c,
      ext/soap/tests/GHSA-85c2-q967-79q5.phpt.
    - CVE-2026-6722
  * SECURITY UPDATE: XSS via incorrect sanitization
    - debian/patches/CVE-2026-6735.patch: GHSA-7qg2-v9fj-4mwv: [fpm] XSS within
      status endpoint in sapi/fpm/fpm/fpm_status.c,
      sapi/fpm/tests/ghsa-7qg2-v9fj-4mwv-status-xss.phpt.
    - CVE-2026-6735
  * SECURITY UPDATE: DoS via passing signed chars
    - debian/patches/CVE-2026-7258.patch: GHSA-m8rr-4c36-8gq4: Consistently pass
      unsigned char to ctype.h functions in Zend/zend_compile.c,
      Zend/zend_ini.c, Zend/zend_operators.c, Zend/zend_virtual_cwd.c,
      Zend/zend_virtual_cwd.h, ext/com_dotnet/com_extension.c,
      ext/date/lib/parse_date.c, ext/date/lib/parse_date.re,
      ext/date/lib/parse_iso_intervals.c, ext/date/lib/parse_iso_intervals.re,
      ext/date/lib/timelib.c, ext/filter/logical_filters.c, ext/ftp/ftp.c,
      ext/gd/libgd/gd_xbm.c, ext/imap/php_imap.c,
      ext/intl/locale/locale_methods.c, ext/mbstring/mbstring.c,
      ext/mbstring/php_mbregex.c, ext/pcre/php_pcre.c, ext/pdo/pdo.c,
      ext/pdo/pdo_sql_parser.re, ext/pdo/pdo_stmt.c, ext/standard/dl.c,
      ext/standard/exec.c, ext/standard/file.c, ext/standard/filters.c,
      ext/standard/formatted_print.c, ext/standard/ftp_fopen_wrapper.c,
      ext/standard/html.c, ext/standard/math.c, ext/standard/metaphone.c,
      ext/standard/quot_print.c, ext/standard/scanf.c, ext/standard/soundex.c,
      ext/standard/string.c, ext/standard/strnatcmp.c, ext/standard/type.c,
      ext/standard/url.c, ext/standard/url_scanner_ex.re,
      ext/standard/versioning.c, main/SAPI.c, main/fopen_wrappers.c,
      main/php_ini.c, main/php_ini_builder.c, main/php_variables.c,
      main/rfc1867.c, main/snprintf.c, main/spprintf.c, main/streams/streams.c,
      main/streams/transports.c, sapi/cli/php_cli_server.c,
      sapi/fpm/fpm/fpm_conf.c, sapi/litespeed/lsapi_main.c,
      sapi/litespeed/lsapilib.c, sapi/phpdbg/phpdbg_cmd.c,
      sapi/phpdbg/phpdbg_prompt.c, sapi/phpdbg/phpdbg_utils.c, win32/sendmail.c.
    - CVE-2026-7258
  * SECURITY UPDATE: null pointer dereference via encoding lists mismatch
    - debian/patches/CVE-2026-7259.patch: GHSA-wm6j-2649-pv75: [mbstring] Fix
      null pointer dereference in php_mb_check_encoding() via
      mb_ereg_search_init() in Zend/tests/GHSA-wm6j-2649-pv75.phpt,
      ext/mbstring/php_mbregex.c.
    - CVE-2026-7259
  * SECURITY UPDATE: use-after-free in SOAP persistance handling
    - debian/patches/CVE-2026-7261.patch: GHSA-m33r-qmcv-p97q: [soap] Fix use-
      after-free after header parsing failure with SOAP_PERSISTENCE_SESSION in
      ext/soap/soap.c, ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt.
    - CVE-2026-7261
  * SECURITY UPDATE: null pointer dereference in SOAP decoding process
    - debian/patches/CVE-2026-7262.patch: GHSA-hmxp-6pc4-f3vv: [soap] Fix broken
      Apache map value NULL check in ext/soap/php_encoding.c,
      ext/soap/tests/GHSA-hmxp-6pc4-f3vv.phpt.
    - CVE-2026-7262
  * SECURITY UPDATE: integer overflow in metaphone
    - debian/patches/CVE-2026-7568.patch: GHSA-96wq-48vp-hh57: [metaphone] Fix
      signed integer overflow of char array offset in ext/standard/metaphone.c,
      ext/standard/tests/GHSA-96wq-48vp-hh57.phpt.
    - CVE-2026-7568

 -- Marc Deslauriers <email address hidden> Mon, 25 May 2026 09:12:06 -0400