Release date:
2026-10-09 10:40:56 UTC
Description:
- CVE-2025-1218: fix mysqlnd wire-protocol packet over-reads
- Also fixes a pre-existing use-after-free on the row-reader failure path: the
CVE-2024-8929 error loops free every field decoded so far without clearing
the zvals, and the result set frees them again at teardown. All 3 sites now
clear after freeing. Confirmed under AddressSanitizer with the Zend allocator
disabled - heap-use-after-free before, clean after, on the three new
short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still
carries the same loops unguarded in php-8.2.34 through php-8.5.11
- The mysqlnd_ps.c hunk additionally releases the result's own connection
reference on the prepare-EOF path: before PHP 7.4 (upstream f365d0e00ed9)
free_result_contents() did not drop it, so that path leaked one reference
Updated packages:
-
alt-php72-7.2.34-96.el9.x86_64.rpm
sha:b958e839ff307cc401be54430dff534cb8c34a91236f8b9848b869e1418182e7
-
alt-php72-bcmath-7.2.34-96.el9.x86_64.rpm
sha:41b04233908a544e7aebf78a6f3540f197457b817c1d28b70dbdb0cc9dfdb7d5
-
alt-php72-cli-7.2.34-96.el9.x86_64.rpm
sha:8c67aed7e74af44508d27a6f6b848c86fcf0d19984e7a229740490d3e1553f5f
-
alt-php72-common-7.2.34-96.el9.x86_64.rpm
sha:7ca69a98128e45eb8ccbe9ec82a5d33c9a51b592f5653afd8273f4b12e46b5c2
-
alt-php72-dba-7.2.34-96.el9.x86_64.rpm
sha:c2c7f78395b6860dc1254e9d51a0ef64f29c6b7d22cf5c3e4719e811977b7797
-
alt-php72-devel-7.2.34-96.el9.x86_64.rpm
sha:73e4abc2a2bbff91209b32cbec2706a083ef2525dcaf026ce4d8316ffff73274
-
alt-php72-enchant-7.2.34-96.el9.x86_64.rpm
sha:a333d4a1bffbfcb4d583f43247e3983adbfbba38f52c30c920e2594f2af881d0
-
alt-php72-firebird-7.2.34-96.el9.x86_64.rpm
sha:23a253c1c2eca1beb1ae00f8ca43ee97b370eeb65a1794880d125dd02b04ea78
-
alt-php72-gd-7.2.34-96.el9.x86_64.rpm
sha:fab49b9076a2fe1967760344e6319e1872d301bc5eddcd2116344ab5bebe2ee5
-
alt-php72-imap-7.2.34-96.el9.x86_64.rpm
sha:7dfacf4d843c49d6c32d93f1a43688a70968782f4218df9c4127efd6f3ec2908
-
alt-php72-intl-7.2.34-96.el9.x86_64.rpm
sha:171add8dfbfb07bb301cad1b7267244ff28a52ec4ca26c13acceff48bc3eeb4d
-
alt-php72-ldap-7.2.34-96.el9.x86_64.rpm
sha:3cf9936b161961d425ee14d7b4e22b87747391e4edeca295a2468f9f6e05ebc0
-
alt-php72-mbstring-7.2.34-96.el9.x86_64.rpm
sha:7ea51770dcf214332abd944cf30a76e221af1218df672928c7c2d02ac8b07e40
-
alt-php72-mysqlnd-7.2.34-96.el9.x86_64.rpm
sha:d5785ab37947af0f56ab1af004f7512a0e86da9787d908eaf75f55f974d89263
-
alt-php72-odbc-7.2.34-96.el9.x86_64.rpm
sha:ea048da8f0095638ac271511e66ec287f3ed03af3f70f273efd2c573802eeacc
-
alt-php72-opcache-7.2.34-96.el9.x86_64.rpm
sha:f60f34a84a01b90b19532fd9998faaf0dd4218f893fbe789f1f0de5eb88768eb
-
alt-php72-pdo-7.2.34-96.el9.x86_64.rpm
sha:521e5cfe2c86060891afce5de66a3c1ad6f4c323e00cc6b03ae5a708d35b8f81
-
alt-php72-pgsql-7.2.34-96.el9.x86_64.rpm
sha:c76915fd555f531b0065f69efa60b0179a80cc8f27ef0dbff8d7d8b8085d7b4d
-
alt-php72-php-fpm-7.2.34-96.el9.x86_64.rpm
sha:599e727420c108c7a17dd9e8c693517de5172725feaaf8faa73aa6d7c2e1ced8
-
alt-php72-process-7.2.34-96.el9.x86_64.rpm
sha:664e2c90feda8e2bc77237b546e98dd236a984c8faae16fc0468cf9b8c148efa
-
alt-php72-pspell-7.2.34-96.el9.x86_64.rpm
sha:afcd6b275aa532b46ce18bf7b3e8377c1d58a61397ce835cb96d37df45a0e76e
-
alt-php72-recode-7.2.34-96.el9.x86_64.rpm
sha:19d2accc3671186b98da682a79029d90066aadf9f3af2d1beef928c81598a6e2
-
alt-php72-snmp-7.2.34-96.el9.x86_64.rpm
sha:033663dcb6d479adbaec9f9123ba210330780dc0efe1ea22d3efd01269622cbb
-
alt-php72-soap-7.2.34-96.el9.x86_64.rpm
sha:39062d479db7ef2b85585e4db24a270a3704dd58185f32855776e099ed9766a2
-
alt-php72-sodium-7.2.34-96.el9.x86_64.rpm
sha:32feebb756b913e8f2b3e4132a7aa6ca34ff770ddef7767c16ad28516f9d4e42
-
alt-php72-tidy-7.2.34-96.el9.x86_64.rpm
sha:f8e3b877caac4abe85b55ba7f36ff27c9436ca69ad0d48b77bda5384f388be41
-
alt-php72-xml-7.2.34-96.el9.x86_64.rpm
sha:45e9b193fe81dce3fe47fd3f4ebe18bc45d87d4ca04b43e192f1b2269ade75c8
-
alt-php72-xmlrpc-7.2.34-96.el9.x86_64.rpm
sha:c3dccc7223bbe1c14dbabe23b57644c1c41fbe485c4a108137fc4d0b8c52fff0
-
alt-php72-zts-7.2.34-96.el9.x86_64.rpm
sha:8ce67c21dee0904ee7a23e80d8cdd79fedd80bb6c29139f58e186a9cecaa02ec
-
alt-php72-zts-devel-7.2.34-96.el9.x86_64.rpm
sha:5b42a956f6b23ca623eddaf43404c0256b39b9782c12ce0218a8d98205f5fe19
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
