## This update for php8 fixes the following issues: * CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser (bsc#1282981). * CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing (bsc#1283216). * CVE-2026-6103: Archive entry injection via integer overflow in TAR parser (bsc#1282980). * CVE-2026-91765: Denial of Service via unbounded recursion in SOAP parser (bsc#1282875). * CVE-2026-91766: Credential disclosure via cross-origin HTTP redirects (bsc#1282876). * CVE-2026-91767: Information disclosure via crafted TLS server certificate (bsc#1282877). * CVE-2026-91768: Access control bypass via partial IPv6 address comparison (bsc#1282878). * CVE-2026-91769: OpenSSL stream peer verification falls back to the Common

* bsc#1282875

* bsc#1282876

* bsc#1282877

* bsc#1282878

* bsc#1282980

* bsc#1282981

* bsc#1282985

* bsc#1282986

* bsc#1283044

* bsc#1283216

Cross-

* CVE-2025-1218

* CVE-2025-14181

* CVE-2026-6103

* CVE-2026-91765

* CVE-2026-91766

* CVE-2026-91767

* CVE-2026-91768

* CVE-2026-91769

* CVE-2026-92842

* CVE-2026-93682

CVSS scores:

* CVE-2025-1218 ( SUSE ): 4.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

* CVE-2025-1218 ( NVD ): 3.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

* CVE-2025-14181 ( SUSE ): 8.3

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

* CVE-2025-14181 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

* CVE-2025-14181 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H