MGASA-2026-0127

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0127.html
Import Source
https://advisories.mageia.org/MGASA-2026-0127.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0127
Upstream
  • CVE-2025-14179
  • CVE-2026-6722
  • CVE-2026-6735
  • CVE-2026-7259
  • CVE-2026-7261
  • CVE-2026-7262
  • CVE-2026-7568
Published
2026-05-13T07:00:52Z
Modified
2026-05-13T07:32:53Z
Summary
Updated php packages fix security vulnerabilities
Details

FPM: Fixed GHSA-7qg2-v9fj-4mwv (XSS within status endpoint). (CVE-2026-6735) MBString: Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (CVE-2026-7259) OpenSSL: Fix compatibility issues with OpenSSL 4.0. PDO_Firebird: Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in quoted strings). (CVE-2025-14179) SOAP:

  • Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (CVE-2026-6722)
  • Fixed GHSA-m33r-qmcv-p97q (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (CVE-2026-7261)
  • Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check). (CVE-2026-7262) Standard:
  • Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  • Fixed GHSA-m8rr-4c36-8gq4 (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258)
References
Credits

Affected packages

Mageia:9 / php

Package

Name
php
Purl
pkg:rpm/mageia/php?arch=source&distro=mageia-9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.2.31-1.mga9

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0127.json"