site/data/distro.json (7215B)
1 {
2 "updated_at": "2026-11-12T03:53:42.014Z",
3 "debian": {
4 "12": {
5 "codename": "bookworm",
6 "packages": {
7 "php8.2": {
8 "fixed": {
9 "CVE-2026-109618": "8.2.35-1~deb12u1",
10 "CVE-2026-109619": "8.2.35-1~deb12u1"
11 },
12 "pro": false
13 }
14 }
15 },
16 "13": {
17 "codename": "trixie",
18 "packages": {
19 "php8.4": {
20 "fixed": {
21 "CVE-2026-109618": "8.4.27-1~deb13u1",
22 "CVE-2026-109619": "8.4.27-1~deb13u1"
23 },
24 "pro": false
25 }
26 }
27 },
28 "14": {
29 "codename": "forky",
30 "packages": {
31 "php8.4": {
32 "fixed": {
33 "CVE-2026-109618": "8.4.27-1",
34 "CVE-2026-109619": "8.4.27-1"
35 },
36 "pro": false
37 }
38 }
39 }
40 },
41 "redhat": {
42 "8": {
43 "advisories": [
44 {
45 "advisory": "RHSA-2026:87073",
46 "cve": "CVE-2026-109618",
47 "package": "php:8.2-8100020261020140951.f7998665"
48 },
49 {
50 "advisory": "RHSA-2026:87080",
51 "cve": "CVE-2026-109618",
52 "package": "php:7.4-8100020261021081045.f7998665"
53 },
54 {
55 "advisory": "RHSA-2026:87073",
56 "cve": "CVE-2026-109619",
57 "package": "php:8.2-8100020261020140951.f7998665"
58 },
59 {
60 "advisory": "RHSA-2026:87080",
61 "cve": "CVE-2026-109619",
62 "package": "php:7.4-8100020261021081045.f7998665"
63 }
64 ],
65 "states": []
66 },
67 "9": {
68 "advisories": [
69 {
70 "advisory": "RHSA-2026:87072",
71 "cve": "CVE-2026-109618",
72 "package": "php:8.2-9080020261020145734.9"
73 },
74 {
75 "advisory": "RHSA-2026:87079",
76 "cve": "CVE-2026-109618",
77 "package": "php:8.3-9080020261020115403.9"
78 },
79 {
80 "advisory": "RHSA-2026:87151",
81 "cve": "CVE-2026-109618",
82 "package": "php-0:8.0.30-8.el9_8.1"
83 },
84 {
85 "advisory": "RHSA-2026:97880",
86 "cve": "CVE-2026-109618",
87 "package": "php:8.4-9090020261020151902.9"
88 },
89 {
90 "advisory": "RHSA-2026:87072",
91 "cve": "CVE-2026-109619",
92 "package": "php:8.2-9080020261020145734.9"
93 },
94 {
95 "advisory": "RHSA-2026:87079",
96 "cve": "CVE-2026-109619",
97 "package": "php:8.3-9080020261020115403.9"
98 },
99 {
100 "advisory": "RHSA-2026:87151",
101 "cve": "CVE-2026-109619",
102 "package": "php-0:8.0.30-8.el9_8.1"
103 },
104 {
105 "advisory": "RHSA-2026:97880",
106 "cve": "CVE-2026-109619",
107 "package": "php:8.4-9090020261020151902.9"
108 }
109 ],
110 "states": []
111 },
112 "10": {
113 "advisories": [
114 {
115 "advisory": "RHSA-2026:87070",
116 "cve": "CVE-2026-109618",
117 "package": "php-0:8.3.36-1.el10_2"
118 },
119 {
120 "advisory": "RHSA-2026:87071",
121 "cve": "CVE-2026-109618",
122 "package": "php8.4-0:8.4.27-1.el10_2"
123 },
124 {
125 "advisory": "RHSA-2026:98609",
126 "cve": "CVE-2026-109618",
127 "package": "php8.4-0:8.4.27-2.el10_3.1"
128 },
129 {
130 "advisory": "RHSA-2026:87070",
131 "cve": "CVE-2026-109619",
132 "package": "php-0:8.3.36-1.el10_2"
133 },
134 {
135 "advisory": "RHSA-2026:87071",
136 "cve": "CVE-2026-109619",
137 "package": "php8.4-0:8.4.27-1.el10_2"
138 },
139 {
140 "advisory": "RHSA-2026:98609",
141 "cve": "CVE-2026-109619",
142 "package": "php8.4-0:8.4.27-2.el10_3.1"
143 }
144 ],
145 "states": []
146 }
147 },
148 "redhat_notes": {
149 "CVE-2026-109618": {
150 "cvss3": "8.1",
151 "severity": "Important",
152 "statement": "Rated Important. An unauthenticated remote attacker could corrupt engine memory and potentially execute arbitrary code, but reliable exploitation requires precise heap manipulation and timing. Standard Red Hat Enterprise Linux deployments use PHP-FPM rather than mod_php. PHP-FPM workers exit on early initialization failures before reaching the corrupted structures, so remote code execution is difficult in practice and typically requires non-default behavior such as parsing a second request body during script execution."
153 },
154 "CVE-2026-109619": {
155 "cvss3": "8.1",
156 "severity": "Important",
157 "statement": "An unauthenticated remote attacker can trigger memory corruption leading to potential arbitrary code execution. In typical Red Hat Enterprise Linux deployments, PHP applications exposed to public networks handle incoming requests directly, so no prior authentication is needed to reach the vulnerable code. Exploitation requires hitting a precise out-of-memory condition during request processing, which keeps this below Critical."
158 }
159 },
160 "schema": 1,
161 "ubuntu": {
162 "14.04": {
163 "codename": "trusty",
164 "packages": {
165 "php5": {
166 "fixed": {
167 "CVE-2026-109618": "5.5.9+dfsg-1ubuntu4.29+esm18",
168 "CVE-2026-109619": "5.5.9+dfsg-1ubuntu4.29+esm18"
169 },
170 "pro": true
171 }
172 }
173 },
174 "16.04": {
175 "codename": "xenial",
176 "packages": {
177 "php7.0": {
178 "fixed": {
179 "CVE-2026-109618": "7.0.33-0ubuntu0.16.04.16+esm22",
180 "CVE-2026-109619": "7.0.33-0ubuntu0.16.04.16+esm22"
181 },
182 "pro": true
183 }
184 }
185 },
186 "18.04": {
187 "codename": "bionic",
188 "packages": {
189 "php7.2": {
190 "fixed": {
191 "CVE-2026-109618": "7.2.24-0ubuntu0.18.04.17+esm14",
192 "CVE-2026-109619": "7.2.24-0ubuntu0.18.04.17+esm14"
193 },
194 "pro": true
195 }
196 }
197 },
198 "20.04": {
199 "codename": "focal",
200 "packages": {
201 "php7.4": {
202 "fixed": {
203 "CVE-2026-109618": "7.4.3-4ubuntu2.29+esm5",
204 "CVE-2026-109619": "7.4.3-4ubuntu2.29+esm5"
205 },
206 "pro": true
207 }
208 }
209 },
210 "22.04": {
211 "codename": "jammy",
212 "packages": {
213 "php8.1": {
214 "fixed": {
215 "CVE-2026-109618": "8.1.2-1ubuntu2.28",
216 "CVE-2026-109619": "8.1.2-1ubuntu2.28"
217 },
218 "pro": false
219 }
220 }
221 },
222 "24.04": {
223 "codename": "noble",
224 "packages": {
225 "php8.3": {
226 "fixed": {
227 "CVE-2026-109618": "8.3.6-0ubuntu0.24.04.13",
228 "CVE-2026-109619": "8.3.6-0ubuntu0.24.04.13"
229 },
230 "pro": false
231 }
232 }
233 },
234 "26.04": {
235 "codename": "resolute",
236 "packages": {
237 "php8.5": {
238 "fixed": {
239 "CVE-2026-109618": "8.5.4-0ubuntu1.5",
240 "CVE-2026-109619": "8.5.4-0ubuntu1.5"
241 },
242 "pro": false
243 }
244 }
245 },
246 "26.10": {
247 "codename": "stonking",
248 "packages": {
249 "php8.5": {
250 "fixed": {
251 "CVE-2026-109618": "8.5.9-0ubuntu2.1",
252 "CVE-2026-109619": "8.5.9-0ubuntu2.1"
253 },
254 "pro": false
255 }
256 }
257 }
258 }
259 }