SUSE alert openSUSE-SU-2026:20113-1 (php8)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:20113-1: moderate: Security update for php8
Date:
             
 
Tue, 27 Jan 2026 17:52:29 +0100
Message-ID:
             
 
<20260127165229.0FA02FF12@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for php8
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:20113-1
Rating: moderate
References:

  * bsc#1255043
  * bsc#1255710
  * bsc#1255711
  * bsc#1255712



Cross-References:

  * CVE-2025-14177
  * CVE-2025-14178
  * CVE-2025-14180



CVSS scores:

  * CVE-2025-14177 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
  * CVE-2025-14177 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
  * CVE-2025-14178 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
  * CVE-2025-14178 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
  * CVE-2025-14180 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2025-14180 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 3 vulnerabilities and has 4 bug fixes can now be installed.

Description:

This update for php8 fixes the following issues:

Version update to 8.4.16:

Security fixes:

- CVE-2025-14177: getimagesize() function may leak uninitialized heap memory into the APPn segments
when reading images in multi-chunk mode (bsc#1255710).
- CVE-2025-14178: heap buffer overflow occurs in array_merge() when the total element count of
packed arrays exceeds 32-bit limits or HT_MAX_SIZE (bsc#1255711).
- CVE-2025-14180: null pointer dereference in pdo_parse_params() function when using the PDO
PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled (bsc#1255712).

Other fixes:

- php8 contains Directories owned by wwwrun but does not require User. (bsc#1255043)


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-198=1

Package List:

- openSUSE Leap 16.0:

  apache2-mod_php8-8.4.16-160000.1.1
  php8-8.4.16-160000.1.1
  php8-bcmath-8.4.16-160000.1.1
  php8-bz2-8.4.16-160000.1.1
  php8-calendar-8.4.16-160000.1.1
  php8-cli-8.4.16-160000.1.1
  php8-ctype-8.4.16-160000.1.1
  php8-curl-8.4.16-160000.1.1
  php8-dba-8.4.16-160000.1.1
  php8-devel-8.4.16-160000.1.1
  php8-dom-8.4.16-160000.1.1
  php8-embed-8.4.16-160000.1.1
  php8-enchant-8.4.16-160000.1.1
  php8-exif-8.4.16-160000.1.1
  php8-fastcgi-8.4.16-160000.1.1
  php8-ffi-8.4.16-160000.1.1
  php8-fileinfo-8.4.16-160000.1.1
  php8-fpm-8.4.16-160000.1.1
  php8-fpm-apache-8.4.16-160000.1.1
  php8-ftp-8.4.16-160000.1.1
  php8-gd-8.4.16-160000.1.1
  php8-gettext-8.4.16-160000.1.1
  php8-gmp-8.4.16-160000.1.1
  php8-iconv-8.4.16-160000.1.1
  php8-intl-8.4.16-160000.1.1
  php8-ldap-8.4.16-160000.1.1
  php8-mbstring-8.4.16-160000.1.1
  php8-mysql-8.4.16-160000.1.1
  php8-odbc-8.4.16-160000.1.1
  php8-opcache-8.4.16-160000.1.1
  php8-openssl-8.4.16-160000.1.1
  php8-pcntl-8.4.16-160000.1.1
  php8-pdo-8.4.16-160000.1.1
  php8-pgsql-8.4.16-160000.1.1
  php8-phar-8.4.16-160000.1.1
  php8-posix-8.4.16-160000.1.1
  php8-readline-8.4.16-160000.1.1
  php8-shmop-8.4.16-160000.1.1
  php8-snmp-8.4.16-160000.1.1
  php8-soap-8.4.16-160000.1.1
  php8-sockets-8.4.16-160000.1.1
  php8-sodium-8.4.16-160000.1.1
  php8-sqlite-8.4.16-160000.1.1
  php8-sysvmsg-8.4.16-160000.1.1
  php8-sysvsem-8.4.16-160000.1.1
  php8-sysvshm-8.4.16-160000.1.1
  php8-test-8.4.16-160000.1.1
  php8-tidy-8.4.16-160000.1.1
  php8-tokenizer-8.4.16-160000.1.1
  php8-xmlreader-8.4.16-160000.1.1
  php8-xmlwriter-8.4.16-160000.1.1
  php8-xsl-8.4.16-160000.1.1
  php8-zip-8.4.16-160000.1.1
  php8-zlib-8.4.16-160000.1.1

References:

  * https://www.suse.com/security/cve/CVE-2025-14177.html
  * https://www.suse.com/security/cve/CVE-2025-14178.html
  * https://www.suse.com/security/cve/CVE-2025-14180.html