SUSE-SU-2026:2091-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20262091-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2091-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2026:2091-1
Upstream
CVE (6)
  • CVE-2026-6722
  • CVE-2026-6735
  • CVE-2026-7258
  • CVE-2026-7261
  • CVE-2026-7262
  • CVE-2026-7568
Related
CVE (6)
  • CVE-2026-6722
  • CVE-2026-6735
  • CVE-2026-7258
  • CVE-2026-7261
  • CVE-2026-7262
  • CVE-2026-7568
Published
2026-05-27T11:52:24Z
Modified
2026-05-28T08:15:05Z
Summary
Security update for php7
Details

This update for php7 fixes the following issues

  • CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).
  • CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS (bsc#1264775).
  • CVE-2026-7258: signed char values passed to ctype functions like isxdigit can lead to OOB access and denial of service (bsc#1264774).
  • CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when SOAP_PERSISTENCE_SESSION is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).
  • CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is configured can lead to a denial of service (bsc#1264771).
  • CVE-2026-7568: integer overflow in the metaphone function can lead to undefined behavior and affect the availability of the PHPprocess (bsc#1264769).
References

Affected packages