SUSE-SU-2026:0825-1

CVE-2025-67746: Fixed ANSI control characters injection in the terminal output of various Composer commands via attacker controlled remote sources. (bsc#1255768)

References

Affected packages

SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 / php-composer2

Package

Name: php-composer2
Purl: pkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.6.4-150600.3.6.1

Ecosystem specific

{
    "binaries":  [
        {
            "php-composer2":  "2.6.4-150600.3.6.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:0825-1.json"

openSUSE:Leap 15.6 / php-composer2

Package

Name: php-composer2
Purl: pkg:rpm/opensuse/php-composer2&distro=openSUSE%20Leap%2015.6

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.6.4-150600.3.6.1

Ecosystem specific

{
    "binaries":  [
        {
            "php-composer2":  "2.6.4-150600.3.6.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:0825-1.json"