SUSE-CU-2026:13650-1: Security update of bci/php-apache

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: bci/php-apache
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13650-1
Container Tags        : bci/php-apache:8 , bci/php-apache:8-sles15 , bci/php-apache:8.3.36 , bci/php-apache:8.3.36-30.2 , bci/php-apache:latest
Container Release     : 30.2
Severity              : important
Type                  : security
References            : 1284043 1284044 1284045 1284046 1284047 1284048 1284049 1284050
                        1284051 1284053 1284054 1284055 1284056 1284057 1284058 1284059
                        1284060 1284061 CVE-2026-42356 CVE-2026-42528 CVE-2026-46729
                        CVE-2026-47360 CVE-2026-48005 CVE-2026-56153 CVE-2026-56154 CVE-2026-57941
                        CVE-2026-58415 CVE-2026-59797 CVE-2026-63045 CVE-2026-63292 CVE-2026-63686
                        CVE-2026-63718 CVE-2026-73636 CVE-2026-73637 CVE-2026-79768 CVE-2026-93546
-----------------------------------------------------------------

The container bci/php-apache was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5077-1
Released:    Tue Nov  3 09:19:57 2026
Summary:     Security update for apache2
Type:        security
Severity:    important
References:  1284043,1284044,1284045,1284046,1284047,1284048,1284049,1284050,1284051,1284053,1284054,1284055,1284056,1284057,1284058,1284059,1284060,1284061,CVE-2026-42356,CVE-2026-42528,CVE-2026-46729,CVE-2026-47360,CVE-2026-48005,CVE-2026-56153,CVE-2026-56154,CVE-2026-57941,CVE-2026-58415,CVE-2026-59797,CVE-2026-63045,CVE-2026-63292,CVE-2026-63686,CVE-2026-63718,CVE-2026-73636,CVE-2026-73637,CVE-2026-79768,CVE-2026-93546
This update for apache2 fixes the following issues:

- CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be treated
  as CGI and executed (bsc#1284043).
- CVE-2026-42528: memory calculation bug in `mod_dav` allows an attacker with permission to create WebDAV locks to crash
  server child processes (bsc#1284044).
- CVE-2026-46729: NULL pointer dereference in `mod_heartmonitor` over unicast listener (bsc#1284045).
- CVE-2026-47360: session cookie passed to a backend server when `SessionCookieRemove` changes across internal redirects
  (bsc#1284046).
- CVE-2026-48005: missing authentication checks in `mod_auth_digest` allows an unauthenticated remote client to cause a
  DoS via forged `Authorization` headers when Digest authentication is enabled with `AuthDigestNcCheck` (bsc#1284047).
- CVE-2026-56153: out-of-bounds write in `mod_charset_lite` (bsc#1284048).
- CVE-2026-56154: use-after-free in `mod_rewrite` when using lookahead `(%{LA-U:HTTP:...})` (bsc#1284049).
- CVE-2026-57941: use-after-free in `mod_http2` via shared `session->bbtmp` re-entrancy (bsc#1284050).
- CVE-2026-58415: internal state files accessible to external parties in `mod_dav_fs` allows a remote client to read
  WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory (bsc#1284051).
- CVE-2026-59797: improper privilege management in `mod_ssl` when using `SSLRequire` and file-related expressions
  (bsc#1284059).
- CVE-2026-63045: improper validation of FTP PASV reply address in `mod_proxy_ftp` allows an untrusted FTP server to
  cause a proxy to open a data connection to an arbitrary third-party host (bsc#1284060).
- CVE-2026-63292: stack-based buffer overflow in `mod_vhost_alias` allows a remote client to cause a DoS or potentially
  execute arbitrary code via an HTTP request with a specially crafted `Host` header (bsc#1284061).
- CVE-2026-63686: NULL pointer dereference in `mod_xml2enc` allows an untrusted backend server to cause a denial of
  service via a crafted proxied response (bsc#1284058).
- CVE-2026-63718: inconsistent interpretation of HTTP requests in `mod_proxy_uwsgi` allows for response smuggling via a
  crafted uwsgi response with `Transfer-Encoding` (bsc#1284057).
- CVE-2026-73636: authentication bypass by capture-replay in `mod_auth_digest` allows a MiTM attacker to replay captured
  digest authentication credentials via crafted requests (bsc#1284056).
- CVE-2026-73637: use-after-free in `mod_auth_digest` allows an unauthenticated remote client to cause authentication
  state corruption via concurrent Digest authentication requests (bsc#1284055).
- CVE-2026-79768: path equivalence issue in the `mod_userdir` module when configured with absolute non-wildcard
  `UserDir` directive (bsc#1284054).
- CVE-2026-93546: integer overflow in `mod_dav_fs` allows an authenticated WebDAV client with write access to crash
  worker processes and persistently corrupt a directory's property database (bsc#1284053).


The following package changes have been done:

- apache2-prefork-2.4.66-150700.4.26.1 updated
- apache2-2.4.66-150700.4.26.1 updated