Bug#1143153: marked as done (php8.4: CVE-2026-7260 CVE-2026-17543 CVE-2026-17544)

This is a multi-part message in MIME format...

------------=_1785772381-2830075-0
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"

Your message dated Mon, 03 Aug 2026 15:51:21 +0000
with message-id <[email protected]>
and subject line Bug#1143153: fixed in php8.4 8.4.24-1~deb13u1
has caused the Debian Bug report #1143153,
regarding php8.4: CVE-2026-7260 CVE-2026-17543 CVE-2026-17544
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)


--=20
1143153: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D1143153
Debian Bug Tracking System
Contact [email protected] with problems

------------=_1785772381-2830075-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at submit) by bugs.debian.org; 31 Jul 2026 05:05:32 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
	(2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-10.0 required=4.0 tests=BAYES_00,FROMDEVELOPER,
	NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no
	version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 33; hammy, 149; neutral, 43; spammy,
	1. spammytokens:0.941-+--H*r:bugs.debian.org
	hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc,
	0.000-+--H*F:U*carnil, 0.000-+--H*Ad:N*Bug, 0.000-+--HTo:N*Debian
Return-path: <[email protected]>
Received: via submission
	by buxtehude.debian.org with esmtp (Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wpfR6-001EIg-1Y
	for [email protected];
	Fri, 31 Jul 2026 05:05:32 +0000
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
From: Salvatore Bonaccorso <[email protected]>
To: Debian Bug Tracking System <[email protected]>
Subject: php8.4: CVE-2026-7260 CVE-2026-17543 CVE-2026-17544
Message-ID: <[email protected]>
X-Mailer: reportbug 13.2.0+nmu1
Date: Fri, 31 Jul 2026 07:05:31 +0200
Delivered-To: [email protected]

U291cmNlOiBwaHA4LjQKVmVyc2lvbjogOC40LjIzLTEKU2V2ZXJpdHk6IGdyYXZlClRhZ3M6IHNl
Y3VyaXR5IHVwc3RyZWFtCkp1c3RpZmljYXRpb246IHVzZXIgc2VjdXJpdHkgaG9sZQpYLURlYmJ1
Z3MtQ2M6IGNhcm5pbEBkZWJpYW4ub3JnLCBEZWJpYW4gU2VjdXJpdHkgVGVhbSA8dGVhbUBzZWN1
cml0eS5kZWJpYW4ub3JnPiwgb25kcmVqQGRlYmlhbi5vcmcKCkhpIE9uZHJlaiwKClRoZSBmb2xs
b3dpbmcgdnVsbmVyYWJpbGl0aWVzIHdlcmUgcHVibGlzaGVkIGZvciBwaHA4LjQuCgpJIGd1ZXNz
IHRoZXkgYXJlIGltcG9ydGFudCBlbm91Z2ggdG8gbWFrZSBhcyB3ZWxsIGEgRFNBLiBUaGVyZSBp
cyBhcyBhCndlbGwgYSBsaWJnZDIgdXBkYXRlLCBidXQgSSBoYXZlIG1hZGUgYSBhc2VwYXJhdGUg
YnVnIGFib3V0IGl0LgoKQ1ZFLTIwMjYtNzI2MFswXToKfCBDaXJjdWxhciBzeW1ib2xpYyBsaW5r
cyBpbiBwaGFyIGFyY2hpdmVzIGNvdWxkIGxlYWQgdG8gdW5ib3VuZGVkCnwgcmVjdXJzaW9uLCBl
eGhhdXN0aW5nIHRoZSBDIHN0YWNrIGFuZCBjcmFzaGluZyB0aGUgUEhQIHByb2Nlc3MswqBpbgp8
IFBIUCB2ZXJzaW9uc8KgZnJvbSA4LjIuKiBiZWZvcmUgOC4yLjMzLCBmcm9tIDguMy4qIGJlZm9y
ZSA4LjMuMzMsCnwgZnJvbSA4LjQuKiBiZWZvcmUgOC40LjI0LCBhbmQgZnJvbSA4LjUuKiBiZWZv
cmUgOC41LjkuCgoKQ1ZFLTIwMjYtMTc1NDNbMV06CnwgSW1wcm9wZXIgZXNjYXBpbmcgb2YgYmFj
a3NsYXNoZXMgaW4gYXR0YWNrZXItcHJvdmlkZWQgcGFyYW1ldGVycwp8IHdvdWxkIGFsbG93IGZv
ciB0cml2aWFsIFNRTCBpbmplY3Rpb24gaW4gUEhQIHZlcnNpb25zwqBmcm9tIDguMi4qCnwgYmVm
b3JlIDguMi4zMywgZnJvbSA4LjMuKiBiZWZvcmUgOC4zLjMzLCBmcm9tIDguNC4qIGJlZm9yZSA4
LjQuMjQsCnwgYW5kIGZyb20gOC41LiogYmVmb3JlIDguNS45LgoKCkNWRS0yMDI2LTE3NTQ0WzJd
Ogp8IEF0dGFja2VyLXByb3ZpZGVkIGlucHV0cyB0byBiY2NvbXAoKSBjb3VsZCBsZWFkIHRvIGFu
IG91dC1vZi1ib3VuZHMKfCB3cml0ZSB3aXRoIHN0YWNrIGFuZCBoZWFwIGNvcnJ1cHRpb24gaW4g
UEhQIHZlcnNpb25zIGZyb20gOC40LioKfCBiZWZvcmUgOC40LjI0IGFuZCBmcm9tIDguNS4qIGJl
Zm9yZSA4LjUuOS4KCgpJZiB5b3UgZml4IHRoZSB2dWxuZXJhYmlsaXRpZXMgcGxlYXNlIGFsc28g
bWFrZSBzdXJlIHRvIGluY2x1ZGUgdGhlCkNWRSAoQ29tbW9uIFZ1bG5lcmFiaWxpdGllcyAmIEV4
cG9zdXJlcykgaWRzIGluIHlvdXIgY2hhbmdlbG9nIGVudHJ5LgoKRm9yIGZ1cnRoZXIgaW5mb3Jt
YXRpb24gc2VlOgoKWzBdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3JnL3RyYWNr
ZXIvQ1ZFLTIwMjYtNzI2MAogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9Q1ZF
LTIwMjYtNzI2MApbMV0gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcvdHJhY2tl
ci9DVkUtMjAyNi0xNzU0MwogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9Q1ZF
LTIwMjYtMTc1NDMKWzJdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3JnL3RyYWNr
ZXIvQ1ZFLTIwMjYtMTc1NDQKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3JkP2lkPUNW
RS0yMDI2LTE3NTQ0CgpSZWdhcmRzLApTYWx2YXRvcmUK

------------=_1785772381-2830075-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at 1143153-close) by bugs.debian.org; 3 Aug 2026 15:51:22 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
	(2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00,
	DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,
	FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,
	USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no
	version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 114; hammy, 150; neutral, 155; spammy,
	0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK,
	0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz,
	0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo
Return-path: <[email protected]>
Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:34664)
	by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wquwk-00Bs5Y-1n
	for [email protected];
	Mon, 03 Aug 2026 15:51:22 +0000
Received: via submission
	from C=NA,ST=NA,L=Ankh Morpork,O=Debian SMTP,OU=Debian SMTP CA,CN=fasolo.debian.org,[email protected] (verified)
	by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wquwk-00H8rU-1X
	for [email protected];
	Mon, 03 Aug 2026 15:51:22 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type:
	Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID
	:Content-Description:In-Reply-To:References;
	bh=lP6eLveGjUltQy8T6baPSXxmDMyVXf8se7bmjJO4fFA=; b=PYcQ6Nvy2dhb3BCS3ANHKYNVTf
	5dQItvCpBjJ8j+oq3t61gZeCJpN+Gp+zNzZ0TkivlD9mcEv0DEFzU/zbvma/YrirmETJTXU/NXbae
	qHWS1G6BLoTx5g2laDNaWUa0vNe2dif7N5BxeBI/KWr99RFbbsDdqbfxKUDBQadRt+6bJXyjWVsKM
	W1nT7Bv1HCrqpSLz427Oqwe5XTus0VdxTNVgq/syZq+mFVF1anvbiHvsVvOkn2oKshfj6Pb2ANeNf
	MquVpOOIq0h5yX22sZ8DEpDIQ2hmtHtyHMCd05kgmv9EX7zBELaa/a8hyKy+Uc2VYest6qeKyYvjh
	0PlE8uJg==;
Received: from dak by fasolo.debian.org with local (Exim 4.98.2)
	(envelope-from <[email protected]>)
	id 1wquwj-00000006rI3-2pOm;
	Mon, 03 Aug 2026 15:51:21 +0000
From: Debian FTP Masters <[email protected]>
Reply-To: =?utf-8?b?T25kxZllaiBTdXLDvQ==?= <[email protected]>
To: [email protected]
X-DAK: dak process-policy
X-Debian: DAK
X-Debian-Package: php8.4
Debian: DAK
Debian-Changes: php8.4_8.4.24-1~deb13u1_source.changes
Debian-Source: php8.4
Debian-Version: 8.4.24-1~deb13u1
Debian-Architecture: source
Debian-Suite: proposed-updates
Debian-Archive-Action: accept
MIME-Version: 1.0
Subject: Bug#1143153: fixed in php8.4 8.4.24-1~deb13u1
Content-Type: multipart/signed; micalg="pgp-sha256";
 protocol="application/pgp-signature";
 boundary="===============7444659768840627512=="
Message-Id: <[email protected]>
Date: Mon, 03 Aug 2026 15:51:21 +0000

--===============7444659768840627512==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Source: php8.4
Source-Version: 8.4.24-1~deb13u1
Done: Ond=C5=99ej Sur=C3=BD <[email protected]>

We believe that the bug you reported is fixed in the latest version of
php8.4, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ond=C5=99ej Sur=C3=BD <[email protected]> (supplier of updated php8.4 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 31 Jul 2026 07:11:11 +0200
Source: php8.4
Architecture: source
Version: 8.4.24-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian PHP Maintainers <[email protected]>
Changed-By: Ond=C5=99ej Sur=C3=BD <[email protected]>
Closes: 1143153
Changes:
 php8.4 (8.4.24-1~deb13u1) trixie-security; urgency=3Dhigh
 .
   * New upstream version 8.4.24 (Closes: #1143153)
    + [CVE-2026-17544]: Out-of-bounds write in bccomp()
    + [CVE-2026-17543]: SQL injection via E'...' backslash breakout
    + [CVE-2026-7260]: Crash via recursive symlinks
Checksums-Sha1:
 41308a37c77ab36f46e38631dcd2f4260b14c3a2 5619 php8.4_8.4.24-1~deb13u1.dsc
 487710711182ab94c04c15c8254efe2cc02f77e4 13752320 php8.4_8.4.24.orig.tar.xz
 a6c16c9b3425efe80574cc0040b64f387bd9a1a9 265 php8.4_8.4.24.orig.tar.xz.asc
 d37394a090133737f2218695fa9df97656fb2956 74756 php8.4_8.4.24-1~deb13u1.debia=
n.tar.xz
 b69b349d864f041a14fe4bf763fbe45b1e3ddcac 34422 php8.4_8.4.24-1~deb13u1_amd64=
.buildinfo
Checksums-Sha256:
 fd84ce153abc1af23514100a25d04acd3c728f5c4b5c30c3e1a0788ef9c780eb 5619 php8.4=
_8.4.24-1~deb13u1.dsc
 e127be09a8506f4327c5cfa78a614b00d210714484ec215ce0011b4a03c00731 13752320 ph=
p8.4_8.4.24.orig.tar.xz
 16643bb748cb7e38f8496989cff457bc01bdd26806aa152b4da6d69fae31068f 265 php8.4_=
8.4.24.orig.tar.xz.asc
 d638895a968c753cb01c28e45b1f21f03ef909f656870a1e52ff0a356d3239cb 74756 php8.=
4_8.4.24-1~deb13u1.debian.tar.xz
 3334a40f265f77e1ef7d7b29de32118ea7e46b3813642e3c00f8917a0b8c6b1f 34422 php8.=
4_8.4.24-1~deb13u1_amd64.buildinfo
Files:
 a12dbeeef697d8054cf2fcb4b51c8724 5619 php optional php8.4_8.4.24-1~deb13u1.d=
sc
 13cb7ced4e0b2ecee75a4a99b262680f 13752320 php optional php8.4_8.4.24.orig.ta=
r.xz
 b52cfc5578c949da87ff0d67e4c6e31a 265 php optional php8.4_8.4.24.orig.tar.xz.=
asc
 5d5897023d1a5f36a87a7337bd8f76d5 74756 php optional php8.4_8.4.24-1~deb13u1.=
debian.tar.xz
 31a3bc96e4c4bc5963700443fa623cb5 34422 php optional php8.4_8.4.24-1~deb13u1_=
amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmpsP/NfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz
NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u
WcJ7Qg//fsBRjf1jqHFvfc5SIpW0TW09vMl88vDIDA8swOMhjtal+5UQ3fqhzoGp
/j6/ULfP68fibvByA0x1e2XtGPboey0CYkZZWuS28lFp0wcWy3Fkd+wJNEakpD4a
4C1quyN+PKLq5E4n+IFZC/fzCg0VPfeoTFjCDFuDMReor+ui0FK2NyA28rk2XC9F
O4Hj83imj/ebfn+qdtzKirnlzb3UCHKR+ajyA8brHwbiKjeTi8IxSttAyE8NIMel
5RoU+7Xdj/acS/zN1ExaKoYckzqLNXp1UB5ZT1844tXoVbJqFem1HknnS4q+KJlH
mJZFZ0hPUxuGXEYu+3uBrJIpwSSkah/eFxtlOq2RqE8DiQKjTjdJJZhmGaubHeyb
IFpoZ7a2Hu2Vli6/6pTcksOoJRoa5H2ANxUc+t2l9wdlO3A1xUK7BoXUVowC3c8W
1r+U4TlXKvyhq3rpuSRX7aSPpSWQdmrDhTAgKo2JXUCw9w96r5Wz6HrbqZLhqIa4
nZ0ifBhGlUGoLmAZP82Ee7wdARf87vJP4+OGcbaTA1Rme1IZotzHTmJdrJrmiqJA
VmdHR6VCOpYIgV3QVlcevfxIWaYjSwkLR/2Zu2gnmunChzxXk1vYyh1iUA39nsxr
zrH7Dy1Q2+hsukjpp/jnq9u2Nnt7r+c0j33Tu1mBfh8KeqN/nME=3D
=3D2zOd
-----END PGP SIGNATURE-----


--===============7444659768840627512==
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCanC4+QAKCRCb9qggYcy5
IRNmAP9pE0Xwif/OS8+HNWJEC6e6IVyrpt4j7qtSBsTZP4cs4gD/U03TQrzNSZHS
476zJdJqYPh3ldyS36ZDqaYEWJdQ1Qg=
=fN6t
-----END PGP SIGNATURE-----

--===============7444659768840627512==--
------------=_1785772381-2830075-0--