SUSE-CU-2026:12109-1: Security update of bci/php-apache

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: bci/php-apache
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12109-1
Container Tags        : bci/php-apache:8 , bci/php-apache:8-sles15 , bci/php-apache:8.3.35 , bci/php-apache:8.3.35-28.6 , bci/php-apache:latest
Container Release     : 28.6
Severity              : important
Type                  : security
References            : 1282875 1282876 1282877 1282878 1282980 1282981 1282985 1282986
                        1283044 1283216 CVE-2025-1218 CVE-2025-14181 CVE-2026-6103 CVE-2026-91765
                        CVE-2026-91766 CVE-2026-91767 CVE-2026-91768 CVE-2026-91769 CVE-2026-92842
                        CVE-2026-93682 
-----------------------------------------------------------------

The container bci/php-apache was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4602-1
Released:    Fri Oct  9 11:58:08 2026
Summary:     Security update for php8
Type:        security
Severity:    important
References:  1282875,1282876,1282877,1282878,1282980,1282981,1282985,1282986,1283044,1283216,CVE-2025-1218,CVE-2025-14181,CVE-2026-6103,CVE-2026-91765,CVE-2026-91766,CVE-2026-91767,CVE-2026-91768,CVE-2026-91769,CVE-2026-92842,CVE-2026-93682
This update for php8 fixes the following issues:

- CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser (bsc#1282981).
- CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing (bsc#1283216).
- CVE-2026-6103: Archive entry injection via integer overflow in TAR parser (bsc#1282980).
- CVE-2026-91765: Denial of Service via unbounded recursion in SOAP parser (bsc#1282875).
- CVE-2026-91766: Credential disclosure via cross-origin HTTP redirects (bsc#1282876).
- CVE-2026-91767: Information disclosure via crafted TLS server certificate (bsc#1282877).
- CVE-2026-91768: Access control bypass via partial IPv6 address comparison (bsc#1282878).
- CVE-2026-91769: OpenSSL stream peer verification falls back to the Common Name whenever no `subjectAltName` matches,
  allowing trusted certificate impersonation (bsc#1283044).
- CVE-2026-92842: Information disclosure via out-of-bounds read in stream filters (bsc#1282985).
- CVE-2026-93682: Out-of-bounds read via empty HTTP redirect Location header (bsc#1282986).

Changes for php8:

- Updated to version 8.3.35


The following package changes have been done:

- php8-cli-8.3.35-150700.3.21.1 updated
- php8-8.3.35-150700.3.21.1 updated
- apache2-mod_php8-8.3.35-150700.3.21.1 updated
- php8-openssl-8.3.35-150700.3.21.1 updated
- php8-mbstring-8.3.35-150700.3.21.1 updated
- php8-zlib-8.3.35-150700.3.21.1 updated
- php8-zip-8.3.35-150700.3.21.1 updated
- php8-curl-8.3.35-150700.3.21.1 updated
- php8-phar-8.3.35-150700.3.21.1 updated