Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package php8 for openSUSE:Factory checked in at 2026-10-22 15:48:31 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/php8 (Old) and /work/SRC/openSUSE:Factory/.php8.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "php8" Thu Oct 22 15:48:31 2026 rev:116 rq:1387117 version:8.5.12 Changes: -------- --- /work/SRC/openSUSE:Factory/php8/php8.changes 2026-10-21 20:52:02.469263798 +0200 +++ /work/SRC/openSUSE:Factory/.php8.new.2252680/php8.changes 2026-10-22 15:48:51.818501639 +0200 @@ -4,3 +4,123 @@ -- version update to 8.5.12 [bsc#1286027] - CVE-2026-109618: memory corruption leading to RCE - CVE-2026-109619: memory corruption leading to RCE +- version update to 8.5.12 + Core: + Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout). (CVE-2026-109618, CVE-2026-109619) [bsc#1286027] + Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison unfolded, crashing the VM in zval_undefined_cv). + Fixed OSS-Fuzz 532353396 (assertion failure with static type). + Fix GH-23662 (Avoid NAN warning in print_r()). + Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object comparison. + Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion). + Fixed AVX being reported as supported when the OS has not enabled AVX state. + Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL). + Fixed use-after-free when a dl()-loaded extension declares a frameless function and a later request calls it. + Fixed System V shared memory emulation for Windows attaching segments past the end of their mapping. + Fixed exception thrown by destructor during GC in a Fiber not being rethrown into the frame that triggered the GC. + BCMath: + Fixed BcMath\Number results that truncate to zero keeping a negative sign and comparing less than zero. + BZ2: + Fixed double close of the descriptor and use-after-free of the inner stream when bzopen() is given a stream resource. + CLI: + Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation). + Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD request for a static file). + Fixed crash in the built-in server when a client is reset before being accepted. + Fixed the built-in server truncating an error page and leaking its unsent part after a partial socket write. + DOM: + Fixed use-after-free when re-constructing a DOMXPath whose php:function registrations are freed while still reachable from the cycle collector. + Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and MathML elements. + Fixed Dom\HTMLDocument giving attributes the namespace of their element when a fragment is parsed with an xlink, xml or xmlns context element. + Fixed bug GH-23887 (Dom\HTMLCollection::namedItem() assertion failure, hang, or missed first element). + Fixed DOMXPath and Dom\XPath losing the context node and in-scope namespaces of an evaluation after a php:function() callback evaluated another expression on the same object. + FFI: + Fixed crashes with FFI callbacks created from __call() trampolines and array callables whose object is released. + FTP: + Fixed bug GH-23619 (cryptic error on servers that don't support TLS session resumption on data connection). + GD: + Fixed undefined behavior with GD2 images with `INT_MAX`-sized chunks. + Fixed undefined behavior with GIFs with problematic LZW compression data. + Intl: + Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state such as dateType, timeType, calendar and the message pattern. + Fixed a crash when converting with a cloned UConverter that uses toUCallback/fromUCallback. + Fixed Collator attribute and strength methods not rejecting an unconstructed Collator. + Fixed crash in intl_error_set_custom_msg() without an active call frame. + Fixed grapheme_strstr() and grapheme_stristr() returning incorrect substrings when supplementary characters precede the match. + Fixed grapheme_strstr() and grapheme_strpos() missing canonically equivalent matches, and grapheme searches reporting ICU errors for empty haystacks. + Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches when using a negative offset. + Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar() treating the offset as UTF-16 code units instead of bytes. + Lexbor: + Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a heap buffer overflow in :lexbor-contains() parsing and buffer overflows in malformed decode replay. + Merge patches lexbor/lexbor@859f100, lexbor/lexbor@a36e09a, lexbor/lexbor@b0f7412, lexbor/lexbor@1b215a8, lexbor/lexbor@385afff, lexbor/lexbor@e6c068f, lexbor/lexbor@327a8b6, + lexbor/lexbor@917742f and lexbor/lexbor@e89c258, fixing dropped usernames containing an at sign, uninitialized memory in IDNA buffer growth, the encoding of a space before a + query or fragment in an opaque path, a query or fragment lost after a dot segment in a path, replacement file drive paths, the output encoding used for percent-encoding, the + URLSearchParams tail pointer and fragment serialization without a query. + MBString: + Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in a truncated UTF-8 sequence). + Fixed mbstring functions emitting surrogates in UTF-8 output and flagging it as valid UTF-8. + MySQLi: + Fix GH-22854: Fixed failed assertion when accessing mysqli property after failed reconnection. + MySQLnd: + Fixed field_count not resetting on OK packet. + Fixed memory leak when closing a prepared statement after its connection was killed. + Opcache: + Fixed OSS-Fuzz #546798343 (Heap-buffer-overflow in optimizer with FCCs and inlining). + Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a loop-invariant addition). + Fixed OSS-Fuzz #5674034779193344 (Read of uninitialized memory in is_cacheable_stream_path()). + Fix zend_analyze_calls() call_stack buffer overrun. + Fixed bug GH-23628 (Tracing JIT reads undefined property slots of lazy proxy objects instead of forwarding to the real instance). + Fixed bug GH-23679 (Tracing JIT writes a parent private property into a child's shadowing public property). + Fix multiple incorrect DCE due to unsound escape analysis. + Fixed bug GH-24063 (OPcache optimizer folds `$cond ? -0.0 : 0.0` into a single `-0.0` constant). + Fixed crash when a file cache is reused with a different set of extensions declaring frameless functions. + Fixed bug GH-23991 (JIT generates invalid IR for multiple recursive calls). + Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object. + Fixed bug GH-20890 (Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT). + OpenSSL: + Fixed stream_socket_enable_crypto() leaving the socket non-blocking after a handshake timeout. + Fixed feof() on a TLS stream staying false after a close_notify on Windows. + PCNTL: + Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while an exception is pending. + Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler that throws. + Fixed bug GH-23986 (/proc/self paths resolve to the parent process after pcntl_fork()). + PDO: + Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid column index. + Fixed PDOStatement::bindColumn() registering a binding for a column name that is not in the result set. + Fixed PDOStatement::execute() leaving the previous result available after a failed execution. + Fixed a use-after-free when bindValue()/execute()/closeCursor() is called from a bound parameter's __toString() during execute(). + Fixed bug GH-23962 (Destroying a persistent PDO instance rolls back a transaction still in use by another instance). + Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class whose constructor arguments it rejects. + Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting "array given" regardless of the value passed. + Fixed PDOStatement::bindParam() and bindColumn() leaking the driver options value. + Fixed PDOStatement not reporting its bound parameters and columns to the cycle collector. + Fixed PDOStatement::setFetchMode() not applying changes atomically. + PDO_DBLIB: + Fixed bug GH-23741 (segfault after a failed query inside a PDO transaction). Errors raised by beginTransaction(), commit(), rollBack() and lastInsertId() are now reported instead of being dropped. + PDO_Firebird: + Fixed bug GH-23758 (PDO_Firebird returns null for non-null empty BLOBs). + PGSQL: + Fixed pg_lo_write() rejecting data containing null bytes. + Removed pg_service(), unavailable with any released libpq. + Readline: + Fixed a heap over-read in the interactive shell prompt when cli.prompt is set to an empty string. + Reflection: + Fixed bug GH-23842 (ReflectionProperty::skipLazyInitialization() copies invalid constant defaults with OPcache). + Session: + Fixed session_start() continuing after a failed create_sid() when session.use_strict_mode rejects the supplied ID. + Fixed exceptions from user-defined create_sid() handlers being replaced by return-value validation errors. + SimpleXML: + Fixed reconstructing a SimpleXMLElement freeing a child element that another variable still references. + SOAP: + Fixed bug GH-22895 (Heap use-after-free while encoding a Traversable with an illegal key). + Fixed memory leak when load_wsdl_ex() failed to load. + SQLite: + Fixed a crash when SQLite3::close() is called from a userland callback. + Standard: + Fixed sha1_file() returning a digest for incomplete data after a stream read failure. + Fixed iptcembed() corrupting JPEG headers when called recursively from an output handler. + Fixed proc_open() leaking descriptor zero when descriptor setup fails. + Fixed three Windows-only proc_open() defects: an uninitialized PROCESS_INFORMATION, an indeterminate comspec pointer after a failed lookup, and an unchecked CreateFileA() failure. + Fix persistent stream context lifetime during shutdown (Levi Morrison) + Fix wordwrap() ignoring an existing break at the end of the string (Nicolas Grekas) + Fixed convert.quoted-printable-decode decoding lowercase hex digits to the wrong byte. + Fixed chown() and lchown() failing to resolve user names in ZTS builds when getpwnam_r() needs a larger buffer. + Tidy: + Fixed a use-after-free when a tidyNode is used after its document is reparsed. + Zlib: + Fixed inflate_init() dropping the preset dictionary for raw streams with a non-default window. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ php8.spec ++++++ --- /var/tmp/diff_new_pack.mEAdCS/_old 2026-10-22 15:48:52.861545282 +0200 +++ /var/tmp/diff_new_pack.mEAdCS/_new 2026-10-22 15:48:52.864545408 +0200 @@ -63,14 +63,12 @@ License: MIT AND PHP-3.01 Group: Development/Libraries/PHP URL: https://secure.php.net -# Source0: https://www.php.net/distributions/php-%{version}.tar.xz -Source0: php-8.5.12.tar.xz +Source0: https://www.php.net/distributions/php-%{version}.tar.xz Source1: mod_%{php_name}.conf Source2: %{php_name}-fpm.conf Source5: README.macros Source6: macros.php -# Source8: https://www.php.net/distributions/php-%{version}.tar.xz.asc -Source8: php-8.5.12.tar.xz.asc +Source8: https://www.php.net/distributions/php-%{version}.tar.xz.asc # Source9: https://www.php.net/distributions/php-keyring.gpg#/%%{php_name}.keyring Source9: %{php_name}.keyring Source11: %{php_name}.rpmlintrc
