Back Linuxsecurity

openSUSE Leap 15.4 PHP8 Critical SQL Injection Vuln 2026-3513

Linuxsecurity •LinuxSecurity Advisories • August 6, 2026

Share: View original

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

This update for php8 fixes the following issues:

* CVE-2026-7260: circular symbolic links in phar archives can lead to

unbounded recursion and cause C stack exhaustion (bsc#1273077).

* CVE-2026-9672: security issues in `libgd` (bsc#1273078).

* CVE-2026-17543: improper escaping of backslashes in user-provided parameters

allows for trivial SQL injection in `ext-pgsql` (bsc#1273075).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Server 15 SP4 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-3513=1

* SUSE Linux Enterprise Server 15 SP5 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-3513=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-3513=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP5

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-3513=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP4

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-3513=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4

zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-3513=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4

zypper in -t patch...

* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)

* php8-sodium-debuginfo-8.0.30-150400.4.73.1

* php8-sysvshm-8.0.30-150400.4.73.1

* php8-snmp-8.0.30-150400.4.73.1

* php8-fastcgi-debugsource-8.0.30-150400.4.73.1

* php8-fpm-debugsource-8.0.30-150400.4.73.1

* php8-sqlite-debuginfo-8.0.30-150400.4.73.1

* php8-bz2-debuginfo-8.0.30-150400.4.73.1

* php8-sysvsem-8.0.30-150400.4.73.1

* php8-dba-8.0.30-150400.4.73.1

* php8-ldap-debuginfo-8.0.30-150400.4.73.1

* php8-pcntl-8.0.30-150400.4.73.1

* php8-gmp-debuginfo-8.0.30-150400.4.73.1

* php8-mysql-8.0.30-150400.4.73.1

* php8-ftp-8.0.30-150400.4.73.1

* php8-soap-8.0.30-150400.4.73.1

* php8-pgsql-8.0.30-150400.4.73.1

* php8-xsl-debuginfo-8.0.30-150400.4.73.1

* php8-pdo-debuginfo-8.0.30-150400.4.73.1

* php8-fpm-debuginfo-8.0.30-150400.4.73.1

* php8-enchant-8.0.30-150400.4.73.1

* php8-sodium-8.0.30-150400.4.73.1

* php8-dba-debuginfo-8.0.30-150400.4.73.1

* php8-test-8.0.30-150400.4.73.1

* php8-ctype-debuginfo-8.0.30-150400.4.73.1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection and C Stack Exhaustion Vulnerabilities in openSUSE PHP Recent updates for openSUSE PHP versions 7 and 8 have revealed critical vulnerabilities, including SQL injection and C stack exhaustion issues. Specifically, CVE-2026-17543 allows for SQL injection through improper escaping of user-provided parameters in `ext-pgsql`, while CVE-2026-7260 can lead to unbounded recursion and C stack exhaustion due to circular symbolic links in phar archives. These vulnerabilities affect multiple SUSE Linux Enterprise Server versions and require immediate patching. The vulnerabilities were disclosed on July 30, 2026, with the first public proof of concept for CVE-2026-17543 released on August 4, 2026. Administrators are urged to apply patches using SUSE's recommended methods. The updates are critical as they could allow attackers to exploit systems, leading to potential data breaches and service disruptions. 9 sources 73

Extracted Entities

openSUSE Leap 15.4 PHP8 Critical SQL Injection Vuln 2026-3513

The full story

Extracted Entities

Attack Types (1)

CVEs (3)

CWE Weaknesses (1)