# changelog

author: Remi Collet <remi@remirepo.net> - 7.2.34-17
changelog:
  - Fix Missing error check and insufficient random bytes in HTTP Digest
    authentication for SOAP
    GHSA-76gg-c692-v2mw  CVE-2023-3247
  - use oracle client library version 21.10


author: Remi Collet <remi@remirepo.net> - 7.2.34-19
changelog:
  - Fix Security issue with external entity loading in XML without enabling it
    GHSA-3qrf-m4j2-pcrr CVE-2023-3823
  - Fix Buffer mismanagement in phar_dir_read()
    GHSA-jqcx-ccgc-xwhv CVE-2023-3824
  - move httpd/nginx wants directive to config files in /etc


author: Remi Collet <remi@remirepo.net> - 7.2.34-20
changelog:
  - use oracle client library version 21.11 on x86_64, 19.19 on aarch64
  - use official Oracle Instant Client RPM


author: Remi Collet <remi@remirepo.net> - 7.2.34-21
changelog:
  - use oracle client library version 21.13 on x86_64, 19.19 on aarch64
  - Fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
    CVE-2024-2756
  - Fix password_verify can erroneously return true opening ATO risk
    CVE-2024-3096


author: Remi Collet <remi@remirepo.net> - 7.2.34-24
changelog:
  - Fix Bypass of CVE-2012-1823, Argument Injection in PHP-CGI
    CVE-2024-4577
  - Fix Bypass of CVE-2024-4577, Parameter Injection Vulnerability
    CVE-2024-8926
  - Fix cgi.force_redirect configuration is bypassable due to the environment variable collision
    CVE-2024-8927
  - Fix Erroneous parsing of multipart form data
    CVE-2024-8925


author: Remi Collet <remi@remirepo.net> - 7.2.34-25
changelog:
  - Fix Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface
    GHSA-4w77-75f9-2c8w
  - Fix OOB access in ldap_escape
    CVE-2024-8932
  - Fix Integer overflow in the dblib/firebird quoter causing OOB writes
    CVE-2024-11236
  - Fix Configuring a proxy in a stream context might allow for CRLF injection in URIs
    CVE-2024-11234
  - Fix Single byte overread with convert.quoted-printable-decode filter
    CVE-2024-11233


