SUSE-CU-2026:9530-1: Security update of bci/php-apache

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: bci/php-apache
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:9530-1
Container Tags        : bci/php-apache:8 , bci/php-apache:8-sles15 , bci/php-apache:8.3.33 , bci/php-apache:8.3.33-26.4 , bci/php-apache:latest
Container Release     : 26.4
Severity              : critical
Type                  : security
References            : 1207866 1274235 1274237 1274850 1274852 1274854 CVE-2022-25147
                        CVE-2025-49506 CVE-2026-32327 CVE-2026-34191 CVE-2026-34501 CVE-2026-34502
-----------------------------------------------------------------

The container bci/php-apache was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3938-1
Released:    Thu Sep  3 09:29:58 2026
Summary:     Security update for apr-util
Type:        security
Severity:    critical
References:  1207866,1274235,1274237,1274850,1274852,1274854,CVE-2022-25147,CVE-2025-49506,CVE-2026-32327,CVE-2026-34191,CVE-2026-34501,CVE-2026-34502
This update for apr-util fixes the following issues:

- CVE-2022-25147: buffer overflow possible with specially crafted input (bsc#1207866).
- CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
- CVE-2026-32327: XML stack recursion crash (bsc#1274235).
- CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).


The following package changes have been done:

- libapr-util1-1.6.1-150600.27.3.1 updated
- container:bci-bci-base-15.7-fc9b0275824beb9e76cff94afae273ff944ad5441726dbf9aad8e917f7c0555e-0 updated
- container:registry.suse.com-bci-bci-base-15.7-fc9b0275824beb9e76cff94afae273ff944ad5441726dbf9aad8e917f7c0555e-0 updated