Release date:
2026-10-09 13:38:19 UTC
Description:
- CVE-2025-1218: fix mysqlnd wire-protocol packet over-reads
- Also fixes a pre-existing use-after-free on the row-reader failure path: the
CVE-2024-8929 error loops free every field decoded so far without clearing
the zvals, and the result set frees them again at teardown. All 3 sites now
clear after freeing. Confirmed under AddressSanitizer with the Zend allocator
disabled - heap-use-after-free before, clean after, on the three new
short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still
carries the same loops unguarded in php-8.2.34 through php-8.5.11
- The mysqlnd_ps.c hunk additionally releases the result's own connection
reference on the prepare-EOF path: before PHP 7.4 (upstream f365d0e00ed9)
free_result_contents() did not drop it, so that path leaked one reference
Updated packages:
-
alt-php72-7.2.34-96.el7.x86_64.rpm
sha:7b286068cf5ad97ae9926f6b65fc4ab4ddcc47fde77144fedd086623f3de081d
-
alt-php72-bcmath-7.2.34-96.el7.x86_64.rpm
sha:d3cb2e144c565ee1142ef0c03c2c6233c1930b44ac40e0f37563a1bc4e0242d4
-
alt-php72-cli-7.2.34-96.el7.x86_64.rpm
sha:8c354faeb1c340d69c3927ebba4d6f6bc6ce354f7bb36e2ff704999efe73e242
-
alt-php72-common-7.2.34-96.el7.x86_64.rpm
sha:c790ad5707297d62d90ec13ae3ecb1dcc84c74c7ea4b9617a744f0a4683d8700
-
alt-php72-dba-7.2.34-96.el7.x86_64.rpm
sha:d26ccf537b5dc9d353934181bab5b4144447df84751a06c685934898329a17de
-
alt-php72-devel-7.2.34-96.el7.x86_64.rpm
sha:4108796d58143a86d27ce9369f5b47487c79ca16dc3174ddaef7678637aa3f1a
-
alt-php72-enchant-7.2.34-96.el7.x86_64.rpm
sha:3ad10e2e8f28f7b103a1ba33b5f4c7f081fa589e23a6d737241ce25205daf55e
-
alt-php72-firebird-7.2.34-96.el7.x86_64.rpm
sha:bee6af463fa85a5f6134ee34298a41dac7a5e82e08d3aeb65cd3c34510de8d71
-
alt-php72-gd-7.2.34-96.el7.x86_64.rpm
sha:91cbab84a0a4801cadcc742f3161c2be62ff469909a301139ed18f9b80723a70
-
alt-php72-imap-7.2.34-96.el7.x86_64.rpm
sha:6979d77ee9788cd852c607a3a0bca3aa698b2c15c6b17669d6732284aa9cd726
-
alt-php72-intl-7.2.34-96.el7.x86_64.rpm
sha:7741372334b65ef223e6eb0b0fee11a48c0a126a2c838bcf493b2e3dcdf88109
-
alt-php72-ldap-7.2.34-96.el7.x86_64.rpm
sha:d6f30af51545dd4999b561f9e937d14393a4f08f1a517378d327190d6a886c35
-
alt-php72-mbstring-7.2.34-96.el7.x86_64.rpm
sha:a9e657e1f1f4398751beee2dc6ce4678e5c43da91b0c4a427f6c8cf4e7b93209
-
alt-php72-mysqlnd-7.2.34-96.el7.x86_64.rpm
sha:a56c21cff427243199292629e8e2c109601affc29440c6db45e5e44f8b03b914
-
alt-php72-odbc-7.2.34-96.el7.x86_64.rpm
sha:d16ea1752ed198f5a50859975e482640ff4c6ce9e347835ff1b5c00f775b9b22
-
alt-php72-opcache-7.2.34-96.el7.x86_64.rpm
sha:cbad72a2b656eeb454c73631509eaec5a5c04c7a3753e6959935b9008b17ad72
-
alt-php72-pdo-7.2.34-96.el7.x86_64.rpm
sha:d6e5d50f2b225277eff25449e16f75b5983e3431d4f05345f5544ac4de84f248
-
alt-php72-pgsql-7.2.34-96.el7.x86_64.rpm
sha:247dff48df3a1e7cda69002ea82672aa214da57daa6bd934a8048b50fe61ff47
-
alt-php72-php-fpm-7.2.34-96.el7.x86_64.rpm
sha:6eebc6aeddb4fbeceeb0de3ba8cf4cf3a0dc3c6b2ef3ccec6a5a2fce4adc37e8
-
alt-php72-process-7.2.34-96.el7.x86_64.rpm
sha:8ca1f347ee1f0983532df301fd0c26e00aef5df03c773f625a4c3d4a3325a51d
-
alt-php72-pspell-7.2.34-96.el7.x86_64.rpm
sha:90ee93bcd9a684e7c912e148b315121119c7d3019d5a11ab3452cf047074a85f
-
alt-php72-recode-7.2.34-96.el7.x86_64.rpm
sha:103b3cf9db6dfa1ecd35572732041d0bc714210e42e0fc7843504467cf5990a9
-
alt-php72-snmp-7.2.34-96.el7.x86_64.rpm
sha:6f5e6b2d02565264932ef1294bdbd55e1c913ab2ebd28ae45c9f5843629ce9ab
-
alt-php72-soap-7.2.34-96.el7.x86_64.rpm
sha:d8740e7362e9aeac8e2259c95f405b47b3c73ca1e913f35805f1591a049eea8e
-
alt-php72-sodium-7.2.34-96.el7.x86_64.rpm
sha:96b8a2df42b84e6db909b74b35adb10c122a32087cc3933ac8da476a27f8b480
-
alt-php72-tidy-7.2.34-96.el7.x86_64.rpm
sha:cccd3a56eb21cb007409f188fb7842d45cd0de9a2a904c9bf300aae2a1b704ef
-
alt-php72-xml-7.2.34-96.el7.x86_64.rpm
sha:bcb4347bb28578f0f9927fcd69fcf70c4b52c7a12227717e9ed7ff5ac1f8bb4f
-
alt-php72-xmlrpc-7.2.34-96.el7.x86_64.rpm
sha:2782bff596d0b96960f470c651ffac7e683b871d65f5ec1bf166d5d310a8e35d
-
alt-php72-zts-7.2.34-96.el7.x86_64.rpm
sha:87285ccdcff2c89bb0c0befcab674ad0014c6c0bb4a20289e031963d69224b5a
-
alt-php72-zts-devel-7.2.34-96.el7.x86_64.rpm
sha:7b8f90660a60e67551d5c94c0bce0cecadf21f626dd35b640575ba099288194a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
