[CLSA-2026:1786592266] Fix CVE(s): CVE-2026-17543, CVE-2026-7260
Type:
security
Severity:
Critical
Release date:
2026-08-13 03:37:57 UTC
Description:
* CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped values escaped by PQescapeStringConn() in an E'...' escape-string constant, but that escaper leaves backslashes untouched when standard_conforming_strings is on, so a trailing backslash escaped the doubling quote and broke out of the literal. Drop the E prefix so the plain '...' form matches what the escaper produces. * CVE-2026-7260: phar circular symlink crash. phar_get_link_source() followed symlink chains by tail recursion with no cycle or depth guard, so a tar phar holding circular links exhausted the C stack. Walk the chain iteratively with Floyd cycle detection and return NULL on a loop; also restore the '/' separator in phar_get_link_location() so the walk stays idempotent.
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-29_amd64.deb
    sha:164650be8c57543d1c006390709a8a242b727b07
  • alt-php81-bcmath_8.1.34-29_amd64.deb
    sha:0bced6c5b96b180b41eed3484202047ebd00952a
  • alt-php81-cli_8.1.34-29_amd64.deb
    sha:d232e10e499f6c396b4893147ba18b88b9658f6a
  • alt-php81-common_8.1.34-29_amd64.deb
    sha:226bf88e0aba4873e0a7bb494cc989c115f7474c
  • alt-php81-dba_8.1.34-29_amd64.deb
    sha:dd20bdee517df01f2ee71385798257918eaecd45
  • alt-php81-dev_8.1.34-29_amd64.deb
    sha:f9ccc884e8709e129f2dc3b0a8e78e37c75b8a56
  • alt-php81-enchant_8.1.34-29_amd64.deb
    sha:220e2f1c6550c284475aef964ed09146532c3224
  • alt-php81-firebird_8.1.34-29_amd64.deb
    sha:6a9b57316b5b0b7e4651ee358b12a8d50c36b053
  • alt-php81-gd_8.1.34-29_amd64.deb
    sha:660ef9c04ed2beed175c37d4d7de1d5a15c73d86
  • alt-php81-imap_8.1.34-29_amd64.deb
    sha:9e4802f0a1ad8c6a5d8268470176720c1fccf9f2
  • alt-php81-intl_8.1.34-29_amd64.deb
    sha:56da2709d942a4a93e6134e32c6494829621a5e8
  • alt-php81-ldap_8.1.34-29_amd64.deb
    sha:73d7da9c6cc92cf3991715a00149ea741de4c0b4
  • alt-php81-mbstring_8.1.34-29_amd64.deb
    sha:be3362b3ef855905b20f883e52bba0fa5ae96756
  • alt-php81-mysqlnd_8.1.34-29_amd64.deb
    sha:b748e10f91183e403bc6c632be960ecad9329121
  • alt-php81-odbc_8.1.34-29_amd64.deb
    sha:5688a90aa0d4f433eb5ee1079fcdb202accc5f4c
  • alt-php81-opcache_8.1.34-29_amd64.deb
    sha:dab113886230b673782ab4b4f12f9a9181cc9e9a
  • alt-php81-pdo_8.1.34-29_amd64.deb
    sha:3ab37952a55586cb41ebff1aa31ba30ec687f7fe
  • alt-php81-pgsql_8.1.34-29_amd64.deb
    sha:178c3d43ec574baf2db23b2fd7e4983b01068b9f
  • alt-php81-php-fpm_8.1.34-29_amd64.deb
    sha:7547f60c8ccacb96aae8cb26bbe20f76baeaf1b2
  • alt-php81-process_8.1.34-29_amd64.deb
    sha:b228c8d748c1a35fdb492f29b2410a680f3d23fd
  • alt-php81-pspell_8.1.34-29_amd64.deb
    sha:8bb2dfe60a8ad941f254fd79b6c67709ff8b2c3b
  • alt-php81-snmp_8.1.34-29_amd64.deb
    sha:8a0dd30698045d41db003f8d9eac4088d7320d31
  • alt-php81-soap_8.1.34-29_amd64.deb
    sha:e7258c618eeae8eabb4ac01c9c503bc6a89270dd
  • alt-php81-sodium_8.1.34-29_amd64.deb
    sha:ff5553f4c46a9f772d3a6510233c578f52fbab39
  • alt-php81-tidy_8.1.34-29_amd64.deb
    sha:f803e9382c11378547b09f3f0bfb58f878bd517d
  • alt-php81-xml_8.1.34-29_amd64.deb
    sha:1bfd896545ebef61e0b5b20c8fc4b253c6f56e11
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.