php7.2 (7.2.24-0ubuntu0.18.04.17+esm13) bionic-security; urgency=medium

  * SECURITY UPDATE: heap buffer over-read in stream filter line-break-chars option
    - debian/patches/CVE-2026-92842.patch: Fix heap-buffer-overflow in convert
      stream filters with NUL in line-break-chars in ext/standard/filters.c,
      ext/standard/tests/filters/ghsa-88hq-2827-7pg6.phpt.
    - CVE-2026-92842
  * SECURITY UPDATE: FastCGI allowed_clients only matched /96 prefix of IPv6 addresses
    - debian/patches/CVE-2026-91768.patch: Fix GHSA-62xp-839h-2637: FastCGI
      allowed_clients compared only 96 bits of IPv6 addresses in main/fastcgi.c,
      sapi/fpm/tests/ghsa-62xp-839h-2637-ipv6-allowed-clients.phpt,
      sapi/fpm/tests/ghsa-62xp-839h-2637-v4mapped-allowed-clients.phpt.
    - CVE-2026-91768
  * SECURITY UPDATE: OpenSSL peer verification incorrectly fell back to CN
    - debian/patches/CVE-2026-91769.patch: Fix GHSA-vvx9-73fr-5jjx: do not fall
      back to CN if the cert has a service ID in
      ext/openssl/tests/san_absent_cn_fallback.phpt,
      ext/openssl/tests/san_no_cn_fallback.phpt,
      ext/openssl/tests/san_peer_matching.phpt,
      ext/openssl/tests/san_srv_no_cn_fallback.phpt,
      ext/openssl/tests/san_uri_no_cn_fallback.phpt, ext/openssl/xp_ssl.c.
    - CVE-2026-91769
  * SECURITY UPDATE: OOB read in wildcard certificate name matching
    - debian/patches/CVE-2026-91767.patch: Fix GHSA-xr7j-rvgx-xq5p: OOB read in
      php_openssl_matches_wildcard_name() in ext/openssl/tests/GHSA-xr7j-rvgx-
      xq5p.phpt, ext/openssl/xp_ssl.c.
    - CVE-2026-91767
  * SECURITY UPDATE: HTTP stream wrapper leaks credentials to cross-origin redirects
    - debian/patches/CVE-2026-91766.patch: Strip auth headers on cross-origin
      redirects . Authorization, Cookie, and Proxy-Authorization set through the
      http context were forwarded verbatim when follow_location sent the request
      to another origin. They are now stripped from the user header bag whenever
      the redirect target differs in scheme, host, or port, including when the
      header name is repeated or the bag uses malformed line endings. in
      ext/standard/http_fopen_wrapper.c, ext/standard/tests/http/bug61548.phpt,
      ext/standard/tests/http/ghsa-fpwc-w8rq-cr92.phpt.
    - CVE-2026-91766
  * SECURITY UPDATE: unbounded recursion in SOAP XML parser allows remote DoS
    - debian/patches/CVE-2026-91765.patch: Fix GHSA-rgrp-mwpx-f6rm: unbounded
      recursion in ext/soap XML parsing and decoding in ext/soap/php_encoding.c,
      ext/soap/php_soap.h, ext/soap/php_xml.c, ext/soap/soap.c,
      ext/soap/tests/GHSA-rgrp-mwpx-f6rm-href-chain.phpt, ext/soap/tests/GHSA-
      rgrp-mwpx-f6rm-href-cycle.phpt, ext/soap/tests/GHSA-rgrp-mwpx-f6rm.phpt.
    - CVE-2026-91765
  * SECURITY UPDATE: heap buffer overflow in SOAP HTTP client response buffer
    - debian/patches/CVE-2025-14181.patch: Fix GHSA-cj93-vc83-wgqv in
      ext/soap/php_http.c, ext/soap/tests/bugs/GHSA-cj93-vc83-wgqv.phpt.
    - CVE-2025-14181
  * SECURITY UPDATE: integer overflow in phar TAR size field allows entry injection
    - debian/patches/CVE-2026-6103.patch: Fix GHSA-j3wh-g957-2m85: phar tar
      entry injection in ext/phar/phar_internal.h, ext/phar/tar.c,
      ext/phar/tests/tar/GHSA-j3wh-g957-2m85-longlink.phpt,
      ext/phar/tests/tar/GHSA-j3wh-g957-2m85-size.phpt,
      ext/phar/tests/tar/GHSA-j3wh-g957-2m85-typeflag.phpt.
    - CVE-2026-6103
  * SECURITY UPDATE: OOB read in HTTP stream wrapper
    - debian/patches/CVE-2026-93682-1.patch: [http] Fix out-of-bounds read on
      empty Location header in ext/standard/http_fopen_wrapper.c,
      ext/standard/tests/http/http_empty_location_redirect.phpt.
    - debian/patches/CVE-2026-93682-2.patch: ext/standard: Fix 1-char relative
      Location redirects after GH-23467 in ext/standard/http_fopen_wrapper.c,
      ext/standard/tests/http/http_single_char_location_redirect.phpt.
    - CVE-2026-93682
  * debian/patches/openssl-server-8.1.patch: Fix GH-16955: Use empheral ports
    for OpenSSL server client tests in ext/openssl/tests/ServerClientTestCase-8.1.inc.

 -- Isabel Garcia Contreras <isabel.garcia@canonical.com>  Wed, 14 Oct 2026 09:53:25 -0400

php7.2 (7.2.24-0ubuntu0.18.04.17+esm12) bionic-security; urgency=medium

  * SECURITY UPDATE: Heap buffer overflow in array_merge()
    - debian/patches/CVE-2025-14178.patch: check number of elements in
      ext/standard/array.c
    - CVE-2025-14178

 -- Nishit Majithia <nishit.majithia@canonical.com>  Wed, 07 Jan 2026 14:02:40 +0530

php7.2 (7.2.24-0ubuntu0.18.04.17+esm11) bionic-security; urgency=medium

  * SECURITY REGRESSION: backport of security fix breaks pg_escape_bytea
    function.
    - debian/patches/CVE-2025-1735.patch: fix position of variable check for
      NULL

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Wed, 03 Sep 2025 14:05:30 +0200

php7.2 (7.2.24-0ubuntu0.18.04.17+esm10) bionic-security; urgency=medium

  * SECURITY REGRESSION: incorrect use of Zend API string free function
    - debian/patches/CVE-2025-1735.patch: refreshed patch to replace the use
      of zend_string_efree with zend_string_release.

 -- Ian Constantin <ian.constantin@canonical.com>  Thu, 28 Aug 2025 23:18:18 +0300

php7.2 (7.2.24-0ubuntu0.18.04.17+esm9) bionic-security; urgency=medium

  [ Marc Deslauriers ]
  * SECURITY UPDATE: Null byte termination in hostnames
    - debian/patches/CVE-2025-1220.patch: check hostnames in
      ext/standard/fsock.c,
      ext/standard/tests/network/ghsa-3cr5-j632-f35r.phpt,
      ext/standard/tests/streams/ghsa-3cr5-j632-f35r.phpt,
      main/streams/xp_socket.c.
    - CVE-2025-1220
  * SECURITY UPDATE: pgsql extension does not check for errors during
    escaping
    - debian/patches/CVE-2025-1735.patch: add error checks in
      ext/pdo_pgsql/pgsql_driver.c,
      ext/pdo_pgsql/tests/ghsa-hrwm-9436-5mv3.phpt,
      ext/pgsql/pgsql.c, ext/pgsql/tests/ghsa-hrwm-9436-5mv3.phpt.
    - CVE-2025-1735
  * SECURITY UPDATE: NULL Pointer Dereference in PHP SOAP Extension via
    Large XML Namespace Prefix
    - debian/patches/CVE-2025-6491.patch: handle large names in
      ext/soap/soap.c, ext/soap/tests/soap_qname_crash.phpt.
    - CVE-2025-6491

 -- Ian Constantin <ian.constantin@canonical.com>  Thu, 21 Aug 2025 04:30:32 +0300

php7.2 (7.2.24-0ubuntu0.18.04.17+esm8) bionic-security; urgency=medium

  * SECURITY UPDATE: misinterpretation of HTTP response headers
    - debian/patches/CVE-2025-1217-*.patch: adds HTTP header folding support
      for HTTP wrapper response headers in ext/standard/http_fopen_wrapper.c.
    - CVE-2025-1217
  * SECURITY UPDATE: insufficient HTTP header validation
    - debian/patches/CVE-2025-1734.patch: adds logic to fail invalid HTTP
      headers in ext/standard/http_fopen_wrapper.c.
    - CVE-2025-1734
  * SECURITY UPDATE: insufficient HTTP header validation
    - debian/patches/CVE-2025-1736*.patch: updates the http user header check
      for crlf in ext/standard/http_fopen_wrapper.c.
    - CVE-2025-1736
  * SECURITY UPDATE: http redirect location truncation
    - debian/patches/CVE-2025-1861.patch: converts the allocation of location
      to be on heap instead of stack and errors if the location length is
      great er than 8086 bytes in ext/standard/http_fopen_wrapper.c.
    - CVE-2025-1861

 -- Ian Constantin <ian.constantin@canonical.com>  Tue, 15 Jul 2025 17:16:28 +0300

php7.2 (7.2.24-0ubuntu0.18.04.17+esm7) bionic-security; urgency=medium

  * SECURITY UPDATE: Integer overflow causing OOB writes
    - debian/patches/CVE-2024-11236.patch: Prevent integer overflow
    - CVE-2024-11236

 -- Julia Sarris <julia.sarris@canonical.com>  Fri, 06 Dec 2024 09:39:22 -0500

php7.2 (7.2.24-0ubuntu0.18.04.17+esm6) bionic-security; urgency=medium

  [ Marc Deslauriers ]
  * SECURITY UPDATE: Erroneous parsing of multipart form data
    - debian/patches/CVE-2024-8925.patch: limit bounday size in
      main/rfc1867.c, tests/basic/*.
    - CVE-2024-8925
  * SECURITY UPDATE: cgi.force_redirect configuration can be bypassed due
    to environment variable collision
    - debian/patches/CVE-2024-8927.patch: check for REDIRECT_STATUS in
      sapi/cgi/cgi_main.c.
    - CVE-2024-8927

 -- Ian Constantin <ian.constantin@canonical.com>  Tue, 12 Nov 2024 17:09:47 +0200

php7.2 (7.2.24-0ubuntu0.18.04.17+esm5) bionic-security; urgency=medium

  * SECURITY UPDATE: improper input validation
    - debian/patches/CVE-2024-5458.patch: updates filtering functions for
      URL validation in ext/filter/logical_filters.c.
    - CVE-2024-5458

 -- Ian Constantin <ian.constantin@canonical.com>  Thu, 05 Sep 2024 15:03:36 +0300

php7.2 (7.2.24-0ubuntu0.18.04.17+esm4) bionic-security; urgency=medium

  * SECURITY REGRESSION: Fix XML parsing such that it correctly tokenises
    html characters such as '&lt', '&gt' and keeps them inplace.
    (LP: #2071768)
    - d/p/CVE-2023-3823.patch: correct the backport in ext/xml/compat.c.

 -- Matthew Ruffell <matthew.ruffell@canonical.com>  Wed, 03 Jul 2024 15:02:50 +1200

php7.2 (7.2.24-0ubuntu0.18.04.17+esm3) bionic-security; urgency=medium

  * SECURITY UPDATE: Cookie by pass
    - debian/patches/CVE-2024-2756.patch: adds more mangling rules
      in main/php_variable.c.
    - CVE-2024-2756
  * SECURITY UPDATE: Account take over risk
    - debian/patches/CVE-2024-3096.patch: disallow null character in bcrypt
      password in ext/standard/password.c,
      ext/standard/tests/password_bcrypt_errors.phpt.
    - CVE-2024-3096

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 22 Apr 2024 13:18:19 -0300

php7.2 (7.2.24-0ubuntu0.18.04.17+esm2) bionic-security; urgency=medium

  * SECURITY UPDATE: Disclosure sensitive information
    - debian/patches/CVE-2023-3823.patch: sanitieze libxml2 globals
      before parsing in ext/dom/document.c, ext/dom/documentfragment.c,
      xml_global_state_entity_loader_bypass.phpt, ext/libxml/php_libxml.h,
      ext/simplexml/simplexml.c, xml_global_state_entity_loader_bypass.phpt,
      ext/soap/php_xml.c, ext/xml/compat.c, ext/xmlreader/php_xmlreader.c,
      xml_global_state_entity_loader_bypass.phpt, ext/xsl/xsltprocessor.c,
      ext/zend_test/test.c.
    - CVE-2023-3823
  * SECURITY UPDATE: Stack buffer overflow
    - debian/patches/CVE-2023-3824.patch: fix buffer mismanagement in
      phar_dir_read(), and in files ext/phar/dirstream.c,
      ext/phar/tests/GHSA-jqcx-ccgx-xwhv.phpt.
    - CVE-2023-3824

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Thu, 22 Feb 2024 08:49:33 -0300

php7.2 (7.2.24-0ubuntu0.18.04.17+esm1) bionic-security; urgency=medium

  [ Leonidas Da Silva Barbosa ]
  * SECURITY UPDATE: Missing error check and insufficient random bytes
    - debian/patches/CVE-2023-3247-1.patch: fixes missing randomness
      check and insufficient random byes for SOAP HTTP digest
      in ext/soap/php_http.c.
    - debian/patches/CVE-2023-3247-2.patch: fix wrong backporting of previous
      soap patch.
    - CVE-2023-3247

 -- Rodrigo Figueiredo Zaiden <rodrigo.zaiden@canonical.com>  Wed, 18 Oct 2023 15:00:12 -0300

php7.2 (7.2.24-0ubuntu0.18.04.17) bionic-security; urgency=medium

  * SECURITY UPDATE: password_verify() accepts invalid Blowfish hashes
    - debian/patches/CVE-2023-0567-1.patch: fix validation of malformed
      BCrypt hashes in ext/standard/crypt_blowfish.c,
      ext/standard/tests/crypt/bcrypt_salt_dollar.phpt.
    - debian/patches/CVE-2023-0567-2.patch: fix possible buffer overread in
      php_crypt() in ext/standard/crypt.c,
      ext/standard/tests/password/password_bcrypt_short.phpt.
    - CVE-2023-0567
  * SECURITY UPDATE: off-by-one in core path resolution function
    - debian/patches/CVE-2023-0568.patch: fix array overrun when appending
      slash to paths in ext/dom/document.c, ext/xmlreader/php_xmlreader.c,
      main/fopen_wrappers.c.
    - CVE-2023-0568
  * SECURITY UPDATE: DoS via excessive number of parts in HTTP form upload
    - debian/patches/CVE-2023-0662-1.patch: introduce
      max_multipart_body_parts INI in main/main.c, main/rfc1867.c.
    - debian/patches/CVE-2023-0662-2.patch: fix repeated warning for file
      uploads limit exceeding in main/rfc1867.c.
    - CVE-2023-0662

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 23 Feb 2023 08:29:25 -0500

php7.2 (7.2.24-0ubuntu0.18.04.16) bionic-security; urgency=medium

  * SECURITY UPDATE: Integer overflow
    - debian/patches/CVE-2022-31631.patch: fix check
      unquotedlen size in ext/pdo_sqlite/sqlite_driver.c.
    - CVE-2022-31631

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Tue, 10 Jan 2023 12:47:23 -0300

php7.2 (7.2.24-0ubuntu0.18.04.15) bionic-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2022-31628-1.patch: adding a recursion limit
      in ext/phar/phar.c, ext/phar/tests/bug81726.phpt.
    - debian/source/include-binaries: add ext/phar/tests/bug81726.gz.
    - debian/patches/CVE-2022-31628-2.patch: avoid a second check in
      ext/phar/phar.c.
    - CVE-2022-31628
  * SECURITY UPDATE: Cookie injection
    - debian/patches/CVE-2022-31629.patch: don't mangle HTTP
      variable names that clash with ones that have a specific semantic
      meaning in ext/standard/test/bug81727.phpt,
      main/php_variables.c.
    - CVE-2022-31629
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2022-37454.patch: fixes buffer overflow in
      hash_update() on long parameter in
      ext/hash/sha3/generic32lc/KeccakSponge.inc,
      ext/hash/sha3/generic64lc/KeccakSponge.inc.
    - CVE-2022-37454

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Wed, 02 Nov 2022 06:09:52 -0300

php7.2 (7.2.24-0ubuntu0.18.04.13) bionic-security; urgency=medium

  * SECURITY REGRESSION: Incomplete fix for CVE-2022-31625 (LP: #1980550)
    - debian/patches/CVE-2022-31625-2.patch: include the fix for not
      freeing parameters which haven't initialized yet in
      ext/pgsql/pgsql.c in other methods.

 -- Rodrigo Figueiredo Zaiden <rodrigo.zaiden@canonical.com>  Wed, 06 Jul 2022 09:23:22 -0300

php7.2 (7.2.24-0ubuntu0.18.04.12) bionic-security; urgency=medium

  * SECURITY UPDATE: RCE via Uninitialized array in pg_query_params()
    - debian/patches/CVE-2022-31625.patch: don't free parameters which
      haven't initialized yet in ext/pgsql/pgsql.c,
      ext/pgsql/tests/bug81720.phpt.
    - CVE-2022-31625
  * SECURITY UPDATE: RCE via mysqlnd/pdo password buffer overflow
    - debian/patches/CVE-20022-31626.patch: properly calculate size in
      ext/mysqlnd/mysqlnd_wireprotocol.c.
    - CVE-2022-31626

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 13 Jun 2022 09:41:53 -0400

php7.2 (7.2.24-0ubuntu0.18.04.11) bionic-security; urgency=medium

  * SECURITY UPDATE: DoS in zend_string_extend function
    - debian/patches/CVE-2017-8923.patch: fix integer Overflow when
      concatenating strings in Zend/zend_vm_def.h, Zend/zend_vm_execute.h.
    - CVE-2017-8923
  * SECURITY UPDATE: out of bounds access in php_pcre_replace_impl
    - debian/patches/CVE-2017-9118-pre1.patch: fix heap buffer overflow via
      str_repeat in Zend/zend_operators.c, Zend/zend_string.h.
    - debian/patches/CVE-2017-9118.patch: fix out of bounds in
      php_pcre_replace_impl in Zend/zend_string.h, ext/pcre/php_pcre.c.
    - CVE-2017-9118
  * SECURITY UPDATE: DoS via memory consumption in i_zval_ptr_dtor
    - debian/patches/CVE-2017-9119.patch: handle memory limit error during
      string reallocation correctly in Zend/zend_string.h.
    - CVE-2017-9119
  * SECURITY UPDATE: DoS via integer overflow in mysqli_real_escape_string
    - debian/patches/CVE-2017-9120.patch: fix overflow in
      ext/mysqli/mysqli_api.c.
    - CVE-2017-9120
  * SECURITY UPDATE: filename truncation issue in XML parsing functions
    - debian/patches/CVE-2021-21707.patch: special character is breaking
      the path in xml function in ext/dom/domimplementation.c,
      ext/dom/tests/bug79971_2.phpt, ext/libxml/libxml.c,
      ext/simplexml/tests/bug79971_1.phpt,
      ext/simplexml/tests/bug79971_1.xml.
    - CVE-2021-21707

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 02 Mar 2022 12:52:35 -0500

php7.2 (7.2.24-0ubuntu0.18.04.10) bionic-security; urgency=medium

  * SECURITY UPDATE: Out of bounds read/write
    - debian/patches/CVE-2021-21703.patch: The main change is to
      store scoreboard procs directly to the variable sized
      array rather than indirectly through the pointer in
      sapi/fpm/fpm/fpm_children.c, sapi/fpm/fpm/fpm_request.c,
      sapi/fpm/fpm/fpm_scoreboard.c, sapi/fpm/fpm/fpm_scoreboard.h,
      sapi/fpm/fpm/fpm_status.c, sapi/fpm/fpm/fpm_worker_pool.c.
    - CVE-2021-21703

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 25 Oct 2021 14:47:59 -0300

php7.2 (7.2.24-0ubuntu0.18.04.9) bionic; urgency=medium

  * Fix a segmentation fault and implement support for using cursors
    on prepared statements in the mysqli database driver. (LP: #1939853)
    - d/p/lp-1939853-1-Fix-Segfault-with-get_result-and-PS-cursors.patch
    - d/p/lp-1939853-2-MySQLnd-Support-cursors-in-store-get-result.patch

 -- Matthew Ruffell <matthew.ruffell@canonical.com>  Mon, 16 Aug 2021 17:46:32 +1200

php7.2 (7.2.24-0ubuntu0.18.04.8) bionic-security; urgency=medium

  * SECURITY UPDATE: crash or info disclosure via PHAR zip file
    - debian/patches/CVE-2020-7068.patch: fix use after free in
      ext/phar/zip.c.
    - CVE-2020-7068
  * SECURITY UPDATE: incorrect URL validation
    - debian/patches/CVE-2020-7071-1.patch: make sure userinfo is valid
      according to RFC 3986 in ext/filter/tests/bug77423.phpt,
      ext/standard/url.c.
    - debian/patches/CVE-2020-7071-2.patch: revert previous fix and use a
      better one in ext/filter/logical_filters.c,
      ext/filter/tests/bug77423.phpt, ext/standard/url.c.
    - debian/patches/CVE-2020-7071-3.patch: remove unneeded function in
      ext/standard/url.c.
    - CVE-2020-7071
  * SECURITY UPDATE: crash via malformed XML data in SOAP extension
    - debian/patches/CVE-2021-21702-1.patch: check strings in
      ext/soap/php_sdl.c, ext/soap/php_xml.c, ext/soap/tests/bug80672.phpt,
      ext/soap/tests/bug80672.xml.
    - debian/patches/CVE-2021-21702-2.patch: fix compiler warning in
      ext/soap/php_sdl.c.
    - CVE-2021-21702
  * SECURITY UPDATE: multiple issues in the pdo_firebase module
    - debian/patches/CVE-2021-21704-1.patch: prevent overflow in
      ext/pdo_firebird/firebird_statement.c.
    - debian/patches/CVE-2021-21704-2.patch: verify result_size in
      ext/pdo_firebird/firebird_statement.c.
    - debian/patches/CVE-2021-21704-3.patch: verify result_size in
      ext/pdo_firebird/firebird_driver.c.
    - debian/patches/CVE-2021-21704-4.patch: don't overflow stack in
      ext/pdo_firebird/firebird_driver.c.
    - CVE-2021-21704
  * SECURITY UPDATE: SSRF bypass
    - debian/patches/CVE-2021-21705.patch: check password in
      ext/filter/logical_filters.c, ext/filter/tests/bug81122.phpt.
    - debian/patches/CVE-2021-21705-2.patch: fix compiler warning in
      ext/filter/logical_filters.c.
    - CVE-2021-21705

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 05 Jul 2021 13:41:32 -0400

php7.2 (7.2.24-0ubuntu0.18.04.7) bionic-security; urgency=medium

  * SECURITY UPDATE: Incorrect encryption data
    - debian/patches/CVE-2020-7069.patch: fix wrong ciphertext/tag
      in AES-CCM encryption for a 12 bytes IV in ext/openssl/openssl.c,
      ext/openssl/tests/cipher_tests.inc, ext/openssl/openssl_*_ccm.phpt.
    - CVE-2020-7069
  * SECURITY UPDATE: Possibly forge cookie
    - debian/patches/CVE-2020-7070.patch: do not decode cookie names anymore
      in main/php_variables.c, tests/basic/022.phpt, tests/basic/023.phpt,
      tests/basic/bug79699.phpt.
    - CVE-2020-7070

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Wed, 07 Oct 2020 12:24:25 -0300

php7.2 (7.2.24-0ubuntu0.18.04.6) bionic-security; urgency=medium

  * SECURITY UPDATE: Denial of service through oversized memory allocated
    - debian/patches/CVE-2019-11048.patch: changes types int to size_t
      in main/rfc1867.c.
    - CVE-2019-11048

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Tue, 26 May 2020 10:09:11 -0300

php7.2 (7.2.24-0ubuntu0.18.04.5) bionic; urgency=medium

  * libapache2-mod-php.postinst.extra: Disable other mod-php
    versions. Fixes failure when upgrading from previous versions of
    mod-php.
   (LP: #1865218)

 -- Bryce Harrington <bryce@canonical.com>  Sat, 25 Apr 2020 02:40:59 +0000

php7.2 (7.2.24-0ubuntu0.18.04.4) bionic-security; urgency=medium

  * SECURITY UDPATE: Null dereference pointer
    - debian/patches/CVE-2020-7062.patch: avoid null dereference in
      ext/session/session.c.
    - CVE-2020-7062
  * SECURITY UPDATE: Lax permissions on files added to tar with Phar
    - debian/patches/CVE-2020-7063.patch: enforce correct permissions
      for files add to tar with Phar in ext/phar/phar_object.c,
      ext/phar/tests/bug79082.phpt, ext/phar/tests/test79082*.
    - CVE-2020-7063
  * SECURITY UPDATE: Read one byte of uninitialized memory
    - debian/patches/CVE-2020-7064.patch: check length in
      exif_process_TIFF_in_JPEG to avoid read uninitialized memory
      ext/exif/exif.c, ext/exif/tests/bug79282.phpt.
    - debian/patches/Fix_test_bug79282.patch: fix test in
      ext/exif/tests/bug79282.phpt.
    - CVE-2020-7064
  * SECURITY UPDATE: Truncated url due \0
    - debian/patches/CVE-2020-7066.patch: check for get_headers
      not accepting \0 in ext/standard/url.c.
    - CVE-2020-7066

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Wed, 08 Apr 2020 12:45:57 -0300

php7.2 (7.2.24-0ubuntu0.18.04.3) bionic-security; urgency=medium

  * SECURITY UPDATE: Out of bounds read
    - debian/patches/CVE-2020-7059.patch: fix OOB read in
      php_strip_tags_ex in ext/standard/string.c and added test
      ext/standard/tests/file/bug79099.phpt.
    - CVE-2020-7059
  * SECURITY UPDATE: Buffer-overflow
    - debian/patches/CVE-2020-7060.patch: fix adding a check function
      is_in_cp950_pua in  ext/mbstring/libmbfl/filters/mbfilter_big5.c
      and added test ext/mbstring/tests/bug79037.phpt.
    - CVE-2020-7060

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Tue, 11 Feb 2020 12:55:52 -0300

php7.2 (7.2.24-0ubuntu0.18.04.2) bionic-security; urgency=medium

  * SECURITY UPDATE: silently truncates
    a class after a null byte
    - debian/patches/CVE-2019-11045.patch:  not accept
      arbitrary strings in ext/spl/spl_directory.c,
      ext/spl/tests/bug78863.phpt.
    - CVE-2019-11045
  * SECURITY UPDATE: Buffer underflow
    - debian/patches/CVE-2019-11046.patch: not rely on `isdigit()`
      to detect digits in ext/bcmath/libbcmath/src/str2num.c,
      ext/bcmath/tests/bug78878.phpt.
    - CVE-2019-11046
  * SECURITY UPDATE: Heap-buffer-overflow
    - debian/patches/CVE-2019-11047.patch: fix in ext/exif/exif.c,
      ext/exif/tests/bug78910.phpt.
    - CVE-2019-11047
  * SECURITY UPDATE: Use-after-free
    - debian/patches/CVE-2019-11050.patch: fix in
      ext/exif/exif.c, ext/exif/tests/bug78793.phpt.
    - CVE-2019-11050

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Mon, 13 Jan 2020 15:39:59 -0300

php7.2 (7.2.24-0ubuntu0.18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: updated to 7.2.24 to fix security issue
    - CVE-2019-11043
  * Rebased patches:
    - debian/patches/0022-lp564920-fix-big-files.patch
  * Removed patches no longer required:
    - debian/patches/CVE-2019-11041.patch
    - debian/patches/CVE-2019-11042.patch

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 28 Oct 2019 08:07:07 -0400

php7.2 (7.2.19-0ubuntu0.18.04.2) bionic-security; urgency=medium

  * SECURITY UPDATE: Heap-buffer-overflow
    - debian/patches/CVE-2019-11041.patch: check Thumbnail.size in order
      to avoid an overflow in ext/exif.exif.c and adding test to
      ext/exif/tests/bug78222.phpt.
    - CVE-2019-11041
  * SECURITY UPDATE: Heap-buffer-overflow
    - debian/patches/CVE-2019-11042.patch: check ByteCount in order to
      avoid an overflow in ext/exif/exif.c and adding tests to
      ext/exif/tests/bug78256.phpt.
    - CVE-2019-11042

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Mon, 12 Aug 2019 16:34:28 -0300

php7.2 (7.2.19-0ubuntu0.18.04.1) bionic-security; urgency=medium

  * Updated to 7.2.19 to fix multiple security issues.
    - CVE-2019-11036
    - CVE-2019-11039
    - CVE-2019-11040
  * Refreshed patches:
    - debian/patches/0039-hack-phpdbg-to-explicitly-link-with-libedit.patch

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 04 Jun 2019 10:48:12 -0400

php7.2 (7.2.17-0ubuntu0.18.04.1) bionic-security; urgency=medium

  * Updated to 7.2.17 to fix multiple security issues.
    - CVE-2019-11034
    - CVE-2019-11035
  * Refreshed patches:
    - debian/patches/0013-Add-support-for-use-of-the-system-timezone-database.patch
  * Removed patches included in new version:
    - debian/patches/CVE-2019-9637.patch
    - debian/patches/CVE-2019-9638-and-CVE-2019-9639-1.patch
    - debian/patches/CVE-2019-9638-and-CVE-2019-9639-2.patch
    - debian/patches/CVE-2019-9640.patch
    - debian/patches/CVE-2019-9641.patch
    - debian/patches/CVE-2019-9675.patch

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 18 Apr 2019 10:12:38 -0400

php7.2 (7.2.15-0ubuntu0.18.04.2) bionic-security; urgency=medium

  * SECURITY UPDATE: Unauthorized users access
    - debian/patches/CVE-2019-9637.patch: fix in
      main/streams/plain_wrapper.c.
    - CVE-2019-9637
  * SECURITY UPDATE: Invalid read in exif_process_IFD_MAKERNOTE
    - debian/patches/CVE-2019-9638-and-CVE-2019-9639-*.patch: fix in
      ext/exif/exif.c, added tests in ext/exif/tests/bug77563.jpg,
      ext/exif/tests/bug77563.phpt.
    - CVE-2019-9638
    - CVE-2019-9639
  * SECURITY UPDATE: Invalid read
    - debian/patches/CVE-2019-9640.patch: fix in
      ext/exif/exif.c, added tests in ext/exif/tests/bug77540.jpg,
      ext/exif/tests/bug77540.phpt.
    - CVE-2019-9640
  * SECURITY UPDATE: Unitialized read
    - debian/patches/CVE-2019-9641.patch: fix in ext/exif/exif.c.
    - CVE-2019-9641
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2019-9675.patch: fix in
      ext/phar/tar.c, added tests in ext/phar/tests/bug71488.phpt,
      ext/phar/tests/bug77586,phpt, ext/phar/tests/bug77586/files/*.

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Fri, 22 Mar 2019 14:05:14 -0300

php7.2 (7.2.15-0ubuntu0.18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Update to 7.2.15 to fix security issues
    - CVE-2018-19935
    - CVE-2018-19518

 -- Mike Salvatore <mike.salvatore@canonical.com>  Fri, 08 Feb 2019 09:54:22 -0500

php7.2 (7.2.10-0ubuntu0.18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Update to 7.2.10 to fix security issues
    - CVE-2015-9253
    - CVE-2018-14851
    - CVE-2018-14883

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 13 Sep 2018 09:45:02 -0400

php7.2 (7.2.7-0ubuntu0.18.04.2) bionic-security; urgency=medium

  * SECURITY UPDATE: 7.2.7 did not actually include the fix for the
    CVE-2018-12882 exif security issue. This release adds backported
    patches to fix the issue.
    - debian/patches/CVE-2018-12882-1.patch: fix heap use after free in
      _php_stream_free in ext/exif/exif.c, ext/exif/tests/bug76409.phpt.
    - debian/patches/CVE-2018-12882-2.patch: fix test portability in
      ext/exif/tests/bug76409.phpt.
    - CVE-2018-12882

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 04 Jul 2018 12:55:24 -0400

php7.2 (7.2.7-0ubuntu0.18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Update to 7.2.7 to fix security issue
    - CVE-2018-12882

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 03 Jul 2018 11:16:52 -0400

php7.2 (7.2.5-0ubuntu0.18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Update to 7.2.5 to fix security issues
    - CVE-2018-10545, CVE-2018-10546, CVE-2018-10547, CVE-2018-10548,
      CVE-2018-10549
  * d/p/0036-php-5.4.9-fixheader.patch: updated for new version.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 09 May 2018 13:21:02 -0400

php7.2 (7.2.3-1ubuntu1) bionic; urgency=medium

  * Merge with Debian unstable (LP: #1744148). Remaining changes:
    - Drop dh-php from Recommends to Suggests so it can be demoted to
      universe as it depends on xml2/universe.

 -- Nishanth Aravamudan <nish.aravamudan@canonical.com>  Wed, 14 Mar 2018 15:03:58 -0700

php7.2 (7.2.3-1) unstable; urgency=medium

  * New upstream version 7.2.3
  * Rebase patches on top of new upstream release.

 -- Ondřej Surý <ondrej@debian.org>  Tue, 06 Mar 2018 11:15:04 +0000

php7.2 (7.2.2-3) unstable; urgency=medium

  * Add explicit libpcre3 >= 2:8.35 dependency as dh_genshlibs is failing
    to add versioned dependency for some reason.

 -- Ondřej Surý <ondrej@debian.org>  Tue, 06 Feb 2018 16:07:40 +0000

php7.2 (7.2.2-2) unstable; urgency=medium

  * Remove explicit libpcre3 dependency and let dh_genshlibs do its magic

 -- Ondřej Surý <ondrej@debian.org>  Tue, 06 Feb 2018 13:00:04 +0000

php7.2 (7.2.2-1ubuntu2) bionic; urgency=medium

  * No-change rebuild against libcurl4

 -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 28 Feb 2018 08:43:55 +0000

php7.2 (7.2.2-1ubuntu1) bionic; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - Drop dh-php from Recommends to Suggests so it can be demoted to
      universe as it depends on xml2/universe.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Fri, 09 Feb 2018 21:18:55 +0000

php7.2 (7.2.2-1) unstable; urgency=medium

  * New upstream version 7.2.2
  * Rebase patches on top of new upstream release
  * Regenerate d/control to finish php7.2-sodium removal

 -- Ondřej Surý <ondrej@debian.org>  Thu, 01 Feb 2018 15:19:04 +0000

php7.2 (7.2.1-1ubuntu2) bionic; urgency=medium

  * d/control.in: also needs update to keep dh-php in universe.

 -- Nishanth Aravamudan <nish.aravamudan@canonical.com>  Wed, 31 Jan 2018 10:36:35 -0800

php7.2 (7.2.1-1ubuntu1) bionic; urgency=medium

  * Drop dh-php from Recommends to Suggests so it can be demoted to
    universe (LP #1590623).
    + dh-php has gained a dependency on xml2 which is in universe.

 -- Nishanth Aravamudan <nish.aravamudan@canonical.com>  Thu, 25 Jan 2018 11:32:42 -0800

php7.2 (7.2.1-1) unstable; urgency=medium

  * Update the Vcs-* to salsa.d.o
  * Slightly update debian/copyright (most changes were already in)
  * New upstream version 7.2.1
  * Rebase patches on top of new upstream release

 -- Ondřej Surý <ondrej@debian.org>  Fri, 05 Jan 2018 11:21:04 +0000

php7.2 (7.2.0-2) unstable; urgency=medium

  * Get rid of extra php7.2-sodium module

 -- Ondřej Surý <ondrej@debian.org>  Wed, 06 Dec 2017 14:15:47 +0000

php7.2 (7.2.0-1) unstable; urgency=low

  * Update PHP 7.2 signing keys
  * New upstream version 7.2.0
  * Rebase patches for new upstream release.

 -- Ondřej Surý <ondrej@debian.org>  Thu, 30 Nov 2017 13:55:57 +0000

php7.2 (7.2.0~rc6-1) unstable; urgency=medium

  * New upstream version 7.2.0~rc6
  * Rebase patches for new upstream version.

 -- Ondřej Surý <ondrej@debian.org>  Sun, 12 Nov 2017 03:30:05 +0000

php7.2 (7.2.0~rc5-1) unstable; urgency=medium

  * New upstream version 7.2.0~rc5
  * Rebase patches for new upstream release

 -- Ondřej Surý <ondrej@debian.org>  Fri, 27 Oct 2017 13:33:55 +0000

php7.2 (7.2.0~rc4-2) unstable; urgency=medium

  * Fix the usage of internal allocator in xmlrpc extension

 -- Ondřej Surý <ondrej@debian.org>  Tue, 24 Oct 2017 18:54:46 +0000

php7.2 (7.2.0~rc4-1) unstable; urgency=medium

  * New upstream version 7.2.0~rc4
  * Rebase patches on top of new upstream version 7.2.0~rc4

 -- Ondřej Surý <ondrej@debian.org>  Sun, 22 Oct 2017 13:07:11 +0000

php7.2 (7.2.0~rc3-1) unstable; urgency=medium

  * New upstream version 7.2.0~rc3
  * Refresh patches for PHP 7.2.0~rc3

 -- Ondřej Surý <ondrej@debian.org>  Thu, 28 Sep 2017 18:26:49 +0200

php7.2 (7.2.0~rc2-1) unstable; urgency=medium

  * New upstream version 7.2.0~rc2
  * Rebase patches on top of PHP 7.2.0~rc2

 -- Ondřej Surý <ondrej@debian.org>  Mon, 18 Sep 2017 11:24:14 +0200

php7.2 (7.2.0~rc1-1) unstable; urgency=medium

  * New upstream version 7.2.0~rc1
  * Rebase patches on top of PHP 7.2.0~rc1
  * Update d/copyright (License check courtesy of Luca Falavigna)
  * Rewrap the files in d/ with wrap-and-sort -a

 -- Ondřej Surý <ondrej@debian.org>  Thu, 31 Aug 2017 14:00:16 +0200

php7.2 (7.2.0~beta3-2) unstable; urgency=medium

  * Enable Argon2 support for password hashing functions
  * Enable shared libsodium extension

 -- Ondřej Surý <ondrej@debian.org>  Fri, 25 Aug 2017 11:35:23 +0200

php7.2 (7.2.0~beta3-1) unstable; urgency=medium

  * Allow libgcrypt11-dev when it's not a transitional package
  * New upstream version 7.2.0~beta3
  * Refresh patches on top of PHP 7.2.0~beta3

 -- Ondřej Surý <ondrej@debian.org>  Fri, 18 Aug 2017 15:00:36 +0200

php7.2 (7.2.0~beta2-2) experimental; urgency=medium

  * Update Vcs-* links to https://gitlab.com/deb.sury.org/...
  * Stop depending on obsolete automake1.11
  * Switch build-depends to libgcrypt20-dev

 -- Ondřej Surý <ondrej@debian.org>  Fri, 04 Aug 2017 11:56:09 +0200

php7.2 (7.2.0~beta2-1) experimental; urgency=medium

  * Update d/watch for PHP 7.2
  * New upstream version 7.2.0~beta2
  * Rebase patches for PHP 7.2.0~beta2

 -- Ondřej Surý <ondrej@debian.org>  Thu, 03 Aug 2017 20:42:38 +0200

php7.2 (7.2.0~beta1-1) experimental; urgency=medium

  * New upstream version 7.2.0~beta1
  * Enable support for libsodium crypto
  * Rebase patches on top of PHP 7.2.0~beta1
  * Update phpapi for PHP 7.2 to 20170718

 -- Ondřej Surý <ondrej@debian.org>  Thu, 27 Jul 2017 13:29:34 +0200

php7.2 (7.2.0~alpha3-1) experimental; urgency=medium

  * New upstream version 7.2.0~alpha3
  * Rebase patches on top of PHP 7.2.0~alpha3
  * Update d/rules with configure.in -> configure.ac rename
  * Remove mcrypt extension that has been removed upstream
  * Update phpapi to 20160731

 -- Ondřej Surý <ondrej@debian.org>  Thu, 06 Jul 2017 13:50:44 +0200
