SUSE-CU-2026:13849-1: Security update of bci/php-apache

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: bci/php-apache
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13849-1
Container Tags        : bci/php-apache:8-micro , bci/php-apache:8.5.12-micro , bci/php-apache:8.5.12-micro-19.8
Container Release     : 19.8
Severity              : critical
Type                  : security
References            : 1247539 1274235 1274237 1274850 1274852 1274854 CVE-2025-49506
                        CVE-2026-32327 CVE-2026-34191 CVE-2026-34501 CVE-2026-34502 
-----------------------------------------------------------------

The container bci/php-apache was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 4
Released:    Tue Oct 27 18:00:02 2026
Summary:     Security update for apr-util
Type:        security
Severity:    critical
References:  1247539,1274235,1274237,1274850,1274852,1274854,CVE-2025-49506,CVE-2026-32327,CVE-2026-34191,CVE-2026-34501,CVE-2026-34502
This update for apr-util fixes the following issues:

- CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
- CVE-2026-32327: XML stack recursion crash (bsc#1274235).
- CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).


The following package changes have been done:

- libapr-util1-0-1.6.3-160100.3.1 updated