-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 24 Sep 2026 19:16:18 +0200
Source: php8.4
Binary: php8.4 php8.4-xsl
Architecture: all
Version: 8.4.26-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: all Build Daemon (x86-grnet-02) <buildd_all-x86-grnet-02@buildd.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Description:
 php8.4     - server-side, HTML-embedded scripting language (metapackage)
 php8.4-xsl - XSL module for PHP (dummy)
Changes:
 php8.4 (8.4.26-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 8.4.26
    + [CVE-2026-91768]: IPv6 ACL bypass in FastCGI listen.allowed_clients
      due to partial address comparison.
    + [CVE-2025-1218]: Various packet overreads in mysqlnd wire protocol.
    + [CVE-2026-91769]: TLS hostname verification falls back to CN after
      SAN mismatch.
    + [CVE-2026-91767]: Heap buffer overflow in
      php_openssl_matches_wildcard_name() on crafted server certificate
      wildcard CN.
    + [CVE-2026-6103]: Integer overflow in phar_tar_number() allowing TAR
      archive entry injection.
    + [CVE-2026-91765]: Unbounded recursion in server-side
      cleanup_xml_node().
    + [CVE-2025-14181]: Integer overflow to buffer overflow in SOAP HTTP
      parsing.
    + [CVE-2026-93682]: Out-of-bounds read in the HTTP stream wrapper when
      following a redirect with an empty Location header.
    + [CVE-2026-92842]: Out-of-bounds read in convert.* stream filters when
      line-break-chars contains NUL.
    + [CVE-2026-91766]: Cross-origin credential leak in HTTP stream wrapper
      redirects.
    + [CVE-2026-17545]: Reserved device names are not rejected before file
      and stream I/O.
Checksums-Sha1:
 ca0ea27357c2c39e8e4f78bf3319fd27970fffa0 54940 php8.4-xsl_8.4.26-1~deb13u1_all.deb
 505244720128ce7aa47823c3a96fda0b1e67cb2f 15441 php8.4_8.4.26-1~deb13u1_all-buildd.buildinfo
 8e0c56b1ad3f8559f346d30d3cec27f8612e6b2f 55292 php8.4_8.4.26-1~deb13u1_all.deb
Checksums-Sha256:
 5409267d80de2645f29682e0bf9375f71e5e31273e2144c4be145a06e38529d6 54940 php8.4-xsl_8.4.26-1~deb13u1_all.deb
 6d3ff038d05ab0157460c5f6954ce544fcfacf53c7e7f3a4316aff6136c99d64 15441 php8.4_8.4.26-1~deb13u1_all-buildd.buildinfo
 bac14b69276f68901778a1a30659f59427d6518d94e559307c78147f786c18aa 55292 php8.4_8.4.26-1~deb13u1_all.deb
Files:
 9881f113966548f21fe3f358ae78bd26 54940 php optional php8.4-xsl_8.4.26-1~deb13u1_all.deb
 43f89ebb6a3a8bba14308d81de384106 15441 php optional php8.4_8.4.26-1~deb13u1_all-buildd.buildinfo
 56ad2689f6c3629ed677d6963212593b 55292 php optional php8.4_8.4.26-1~deb13u1_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmq1d28ACgkQmgPNRvTf
/zd+3xAAxojq92ixgdZk1f1M9l51hPuSh9i9rGHmBJRgjtgWLXwwH3xsDvJZBjWZ
SjgIhoma5bYAZXabIo3c3zOiI3pxFbndHxaQjuEY4kEVlM8tEjkDApTuJmRq3CuE
tZtBAgTx+JpwlGgWH8XTT8Kwpj7qzsr9vx2D5mR+MsF5KlXLJH8JZx5trfcYMWcp
+L3ve+mbCVolHsuMu5Kd0jt3EINx4rwf7T1N9edX/KCk4+drpjR5T36ezA/qikVv
vaoWYGMmd+yD8XjAKfqELqL57T4dP36Skjaf9ReJDjmfptl0uFUVaxwhO4jsxs0Q
hpl+3tBAJUC6uJJcsGS3BxbLsyG1GwGg9yAcKpOtsoTPK3VQgH+V48NTBeUNo+nV
egFdFLeHdcZnvHyyjxt5M/kHgFlLIqnfj9QDoEjMICRZPejxFwcnFof3NVs3eBEn
zhLbBaoB1W0LCEeDmJnLPY7mTbAb+wN3Qll6qnvWO7ikALQFXlem6iMd1YgGJpwv
UQ9XUQyRSalW/nia+X9sEyboUNfwWR1X/0BlURM5A9OHyJHkZXVaTcx0UHEzsQeL
xVNh3uKT5wj5tNkM24tHPJiwL1i/l4aKe3TkmNo7XTDdd3e8Xv6Nhn5eyYOPpUyJ
rxKDmIhKyc7RdaMMUAPzufp8eXMrdxji6e7CMzET+HKbfcuVSbk=
=yQC/
-----END PGP SIGNATURE-----