From 0dfac4dd3fda47baf4f60a0e570b27526dea9e59 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Mon, 6 Jul 2026 16:11:51 +0200 Subject: [PATCH] package/php: security bump to v8.3.32 See the release notes: https://www.php.net/ChangeLog-8.php#8.3.32 This fixes 2 vulnerabilities: - CVE-2026-12184: Segfault in file_get_contents w/ a https URL and a proxy set - CVE-2026-14355: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD Signed-off-by: Titouan Christophe Signed-off-by: Thomas Perale --- package/php/php.hash | 2 +- package/php/php.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/php/php.hash b/package/php/php.hash index 978987ee46..11c0b2e6b0 100644 --- a/package/php/php.hash +++ b/package/php/php.hash @@ -1,5 +1,5 @@ # From https://www.php.net/downloads.php -sha256 66410cee07f4b2baeb0843140bb2a2b52ef930b5cf9b3d6e6d158b33aae8fa37 php-8.3.31.tar.xz +sha256 8698ec1f9402fa5e5e872ae3d0916b62f5f27503c1fbfc9cc3521e113355ea92 php-8.3.32.tar.xz # License file sha256 b42e4df5e50e6ecda1047d503d6d91d71032d09ed1027ba1ef29eed26f890c5a LICENSE diff --git a/package/php/php.mk b/package/php/php.mk index 7d9cd3cb11..9ce3b280ac 100644 --- a/package/php/php.mk +++ b/package/php/php.mk @@ -4,7 +4,7 @@ # ################################################################################ -PHP_VERSION = 8.3.31 +PHP_VERSION = 8.3.32 PHP_SITE = https://www.php.net/distributions PHP_SOURCE = php-$(PHP_VERSION).tar.xz PHP_INSTALL_STAGING = YES