Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package php8 for openSUSE:Factory checked in at 2026-10-21 20:52:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/php8 (Old) and /work/SRC/openSUSE:Factory/.php8.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "php8" Wed Oct 21 20:52:00 2026 rev:115 rq:1386921 version:8.5.12 Changes: -------- --- /work/SRC/openSUSE:Factory/php8/php8.changes 2026-09-30 16:23:52.525412413 +0200 +++ /work/SRC/openSUSE:Factory/.php8.new.2252680/php8.changes 2026-10-21 20:52:02.469263798 +0200 @@ -1,0 +2,9 @@ +Wed Oct 21 07:25:32 UTC 2026 - Petr Gajdos <[email protected]> + +- version update to 8.5.12 [bsc#1286027] + CVE-2026-109618: memory corruption leading to RCE + CVE-2026-109619: memory corruption leading to RCE +- modified patches + * php-build-reproducible-phar.patch (refreshed) + +------------------------------------------------------------------- Old: ---- php-8.5.11.tar.xz php-8.5.11.tar.xz.asc New: ---- php-8.5.12.tar.xz php-8.5.12.tar.xz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ php8.spec ++++++ --- /var/tmp/diff_new_pack.SxPRwh/_old 2026-10-21 20:52:03.650313050 +0200 +++ /var/tmp/diff_new_pack.SxPRwh/_new 2026-10-21 20:52:03.654313217 +0200 @@ -57,18 +57,20 @@ %bcond_without sodium Name: %{pprefix}%{php_name}%{psuffix} -Version: 8.5.11 +Version: 8.5.12 Release: 0 Summary: Interpreter for the PHP scripting language version 8 License: MIT AND PHP-3.01 Group: Development/Libraries/PHP URL: https://secure.php.net -Source0: https://www.php.net/distributions/php-%{version}.tar.xz +# Source0: https://www.php.net/distributions/php-%{version}.tar.xz +Source0: php-8.5.12.tar.xz Source1: mod_%{php_name}.conf Source2: %{php_name}-fpm.conf Source5: README.macros Source6: macros.php -Source8: https://www.php.net/distributions/php-%{version}.tar.xz.asc +# Source8: https://www.php.net/distributions/php-%{version}.tar.xz.asc +Source8: php-8.5.12.tar.xz.asc # Source9: https://www.php.net/distributions/php-keyring.gpg#/%%{php_name}.keyring Source9: %{php_name}.keyring Source11: %{php_name}.rpmlintrc ++++++ php-8.5.11.tar.xz -> php-8.5.12.tar.xz ++++++ /work/SRC/openSUSE:Factory/php8/php-8.5.11.tar.xz /work/SRC/openSUSE:Factory/.php8.new.2252680/php-8.5.12.tar.xz differ: char 13, line 1 ++++++ php-build-reproducible-phar.patch ++++++ --- /var/tmp/diff_new_pack.SxPRwh/_old 2026-10-21 20:52:03.858321724 +0200 +++ /var/tmp/diff_new_pack.SxPRwh/_new 2026-10-21 20:52:03.864321974 +0200 @@ -16,11 +16,11 @@ ext/phar/zip.c | 2 +- 6 files changed, 18 insertions(+), 5 deletions(-) -Index: php-8.5.9/ext/phar/phar.c +Index: php-8.5.12/ext/phar/phar.c =================================================================== ---- php-8.5.9.orig/ext/phar/phar.c -+++ php-8.5.9/ext/phar/phar.c -@@ -2950,7 +2950,7 @@ int phar_flush_ex(phar_archive_data *pha +--- php-8.5.12.orig/ext/phar/phar.c ++++ php-8.5.12/ext/phar/phar.c +@@ -2953,7 +2953,7 @@ int phar_flush_ex(phar_archive_data *pha 4: metadata-len +: metadata */ @@ -29,11 +29,11 @@ phar_set_32(entry_buffer, entry->uncompressed_filesize); phar_set_32(entry_buffer+4, mytime); phar_set_32(entry_buffer+8, entry->compressed_filesize); -Index: php-8.5.9/ext/phar/phar_internal.h +Index: php-8.5.12/ext/phar/phar_internal.h =================================================================== ---- php-8.5.9.orig/ext/phar/phar_internal.h -+++ php-8.5.9/ext/phar/phar_internal.h -@@ -315,6 +315,21 @@ static inline php_stream *phar_get_pharf +--- php-8.5.12.orig/ext/phar/phar_internal.h ++++ php-8.5.12/ext/phar/phar_internal.h +@@ -320,6 +320,21 @@ static inline php_stream *phar_get_pharf return PHAR_G(cached_fp)[phar->phar_pos].fp; } @@ -55,10 +55,10 @@ static inline enum phar_fp_type phar_get_fp_type(const phar_entry_info *entry) { if (!entry->is_persistent) { -Index: php-8.5.9/ext/phar/stream.c +Index: php-8.5.12/ext/phar/stream.c =================================================================== ---- php-8.5.9.orig/ext/phar/stream.c -+++ php-8.5.9/ext/phar/stream.c +--- php-8.5.12.orig/ext/phar/stream.c ++++ php-8.5.12/ext/phar/stream.c @@ -469,7 +469,7 @@ static int phar_stream_flush(php_stream phar_entry_data *data = (phar_entry_data *) stream->abstract; @@ -68,11 +68,11 @@ ret = phar_flush(data->phar, &error); if (error) { php_stream_wrapper_log_error(stream->wrapper, REPORT_ERRORS, "%s", error); -Index: php-8.5.9/ext/phar/tar.c +Index: php-8.5.12/ext/phar/tar.c =================================================================== ---- php-8.5.9.orig/ext/phar/tar.c -+++ php-8.5.9/ext/phar/tar.c -@@ -977,7 +977,7 @@ int phar_tar_flush(phar_archive_data *ph +--- php-8.5.12.orig/ext/phar/tar.c ++++ php-8.5.12/ext/phar/tar.c +@@ -1047,7 +1047,7 @@ int phar_tar_flush(phar_archive_data *ph char *buf, *signature, sigbuf[8]; entry.flags = PHAR_ENT_PERM_DEF_FILE; @@ -81,10 +81,10 @@ entry.is_modified = 1; entry.is_crc_checked = 1; entry.is_tar = 1; -Index: php-8.5.9/ext/phar/util.c +Index: php-8.5.12/ext/phar/util.c =================================================================== ---- php-8.5.9.orig/ext/phar/util.c -+++ php-8.5.9/ext/phar/util.c +--- php-8.5.12.orig/ext/phar/util.c ++++ php-8.5.12/ext/phar/util.c @@ -729,7 +729,7 @@ phar_entry_data *phar_get_or_create_entr phar_add_virtual_dirs(phar, path, path_len); @@ -94,10 +94,10 @@ etemp.is_crc_checked = 1; etemp.phar = phar; etemp.filename = zend_string_init(path, path_len, false); -Index: php-8.5.9/ext/phar/zip.c +Index: php-8.5.12/ext/phar/zip.c =================================================================== ---- php-8.5.9.orig/ext/phar/zip.c -+++ php-8.5.9/ext/phar/zip.c +--- php-8.5.12.orig/ext/phar/zip.c ++++ php-8.5.12/ext/phar/zip.c @@ -1275,7 +1275,7 @@ int phar_zip_flush(phar_archive_data *ph pass.error = &temperr;
