Threats affecting pkg:deb/suse/php8

A security update for php8 addresses a buffer allocation flaw in the AES-WRAP-PAD algorithm implementation within the OpenSSL extension. This flaw is tracked as CVE-2026-14355 and is fixed in version 8.4.23. The vulnerability has been assigned a medium severity rating.

This security update for PHP 8 addresses multiple vulnerabilities including SQL injection, out-of-bounds reads, use-after-free, cross-site scripting (XSS), denial of service, memory corruption, information disclosure, and infinite loops. The update also includes an upgrade to PHP version 8.4.21. These issues affect various components such as the PDO Firebird driver, mbstring encoding functions, SOAP handling, PHP-FPM status page, ctype functions, and XML processing.