[CLSA-2026:1786591767] Fix CVE(s): CVE-2026-17543, CVE-2026-7260, CVE-2026-9672
Type:
security
Severity:
Critical
Release date:
2026-08-13 03:29:38 UTC
Description:
* CVE-2026-9672: bundled libgd GIF LZW decoder read an uninitialised code table (sd->table[1][0] instead of sd->table[1][i] in the reset loop, plus an uninitialised LZW_STATIC_DATA on the stack) and kept decoding past an end-of-stream code * CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted values escaped by PQescapeStringConn() inside an E'...' constant, so a trailing backslash broke out of the literal (SQL injection); emit a plain '...' constant instead * CVE-2026-7260: phar_get_link_source() followed tar symlink chains by unbounded recursion, so a phar with circular symlinks exhausted the C stack; walk the chain iteratively with Floyd cycle detection
CVEs fixed:
Updated packages:
  • alt-php73_7.3.33-74_amd64.deb
    sha:5747d90458c39726d242919a0094f829de0ae56b
  • alt-php73-bcmath_7.3.33-74_amd64.deb
    sha:c23261ad9fe3f1314cd8d786b5f7940411b68f40
  • alt-php73-cli_7.3.33-74_amd64.deb
    sha:04873576fa9a44a8813525d6ac874cac2892fb54
  • alt-php73-common_7.3.33-74_amd64.deb
    sha:559ffbc57c5256510cf3fa3fa2d2c3ad7d197e4d
  • alt-php73-dba_7.3.33-74_amd64.deb
    sha:76223206dd590da4fe78e3fd9bd6812cfdbe51db
  • alt-php73-dev_7.3.33-74_amd64.deb
    sha:0d7d4828373ddf9a1f9343baf44fc56634550604
  • alt-php73-enchant_7.3.33-74_amd64.deb
    sha:a2cef4b26e4f916348d0565d5633c60016534097
  • alt-php73-firebird_7.3.33-74_amd64.deb
    sha:d24a1f61d3cfbef749f3ef8830595f8bac4d7b7d
  • alt-php73-gd_7.3.33-74_amd64.deb
    sha:8d2c252a2ed670b99da2c57d5fdc9604b18f655e
  • alt-php73-imap_7.3.33-74_amd64.deb
    sha:59a53f1a46b61232515ca54e0a5a7840361f7ba6
  • alt-php73-intl_7.3.33-74_amd64.deb
    sha:bc4badc336f40d690e73ef968cb7aa117e8cba58
  • alt-php73-ldap_7.3.33-74_amd64.deb
    sha:8c387b697dc3e89b10ce28d216c6bf0d8702fb58
  • alt-php73-mbstring_7.3.33-74_amd64.deb
    sha:51750ca4089b1f92c38adb29e72a883d9cee3387
  • alt-php73-mysqlnd_7.3.33-74_amd64.deb
    sha:b0375eada19b23264f4aac1ec52f8e2a37e7f267
  • alt-php73-odbc_7.3.33-74_amd64.deb
    sha:f0a27d5b2f16c24e6f827f338c8ef7d0b853cbed
  • alt-php73-opcache_7.3.33-74_amd64.deb
    sha:ae836384edc64bbf117803ec761a29d411bd07ff
  • alt-php73-pdo_7.3.33-74_amd64.deb
    sha:1d6da35738bee42d50fbaba35d07e96148d99e5e
  • alt-php73-pgsql_7.3.33-74_amd64.deb
    sha:74def6d253d4f9aecc27d6f00a4b019b784d64ea
  • alt-php73-php-fpm_7.3.33-74_amd64.deb
    sha:c42062e1215e2f96047ecf27453f4dc5a3069663
  • alt-php73-process_7.3.33-74_amd64.deb
    sha:dd84fdf057a2147ebb1761524e218957ca838d46
  • alt-php73-pspell_7.3.33-74_amd64.deb
    sha:c0c403906dca260651c0dddae4e16d1a215b26c4
  • alt-php73-recode_7.3.33-74_amd64.deb
    sha:3d86e52196148d780baaca4df2927552b407dae6
  • alt-php73-snmp_7.3.33-74_amd64.deb
    sha:460fbdb7f5e6043206f3abb8cea9f94b62e1e12b
  • alt-php73-soap_7.3.33-74_amd64.deb
    sha:c811456e049adbcae67ecb93e0b330bf2fb553b0
  • alt-php73-sodium_7.3.33-74_amd64.deb
    sha:50552044b7b14dcd03cda743f3556318833e2c4f
  • alt-php73-tidy_7.3.33-74_amd64.deb
    sha:e32429c78ad78f9fa9023dcbe46e9e45e8f2564e
  • alt-php73-xml_7.3.33-74_amd64.deb
    sha:124a7a264bc5a94015f4aba08086217c11680d1c
  • alt-php73-xmlrpc_7.3.33-74_amd64.deb
    sha:65035878e87f04fa09be783e842a003aafe5e897
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.