[CLSA-2026:1786593252] Fix CVE(s): CVE-2026-17543, CVE-2026-7260
Type:
security
Severity:
Critical
Release date:
2026-08-13 03:54:22 UTC
Description:
* CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped values escaped by PQescapeStringConn() in an E'...' escape-string constant, but that escaper leaves backslashes untouched when standard_conforming_strings is on, so a trailing backslash escaped the doubling quote and broke out of the literal. Drop the E prefix so the plain '...' form matches what the escaper produces. * CVE-2026-7260: phar circular symlink crash. phar_get_link_source() followed symlink chains by tail recursion with no cycle or depth guard, so a tar phar holding circular links exhausted the C stack. Walk the chain iteratively with Floyd cycle detection and return NULL on a loop; also restore the '/' separator in phar_get_link_location() so the walk stays idempotent.
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-29_amd64.deb
    sha:164650be8c57543d1c006390709a8a242b727b07
  • alt-php81-bcmath_8.1.34-29_amd64.deb
    sha:013a5f80a9d8e07f42fb5f0afb7c315016f1a3b6
  • alt-php81-cli_8.1.34-29_amd64.deb
    sha:33c0def3b2ed4ecec09bca1b32abeb70af25dbe6
  • alt-php81-common_8.1.34-29_amd64.deb
    sha:7be45ce43e9637cb143d6338e4ef522c2a9d415d
  • alt-php81-dba_8.1.34-29_amd64.deb
    sha:04f90190f29bc671c891c931b8e9d8704f417712
  • alt-php81-dev_8.1.34-29_amd64.deb
    sha:f6eaa5830488294a912c0c7d647edcdb82b85f73
  • alt-php81-enchant_8.1.34-29_amd64.deb
    sha:308bde68816aac25eb073775e96dd7bd3f82bf93
  • alt-php81-firebird_8.1.34-29_amd64.deb
    sha:bac87d7454b434491d62db2963b7437a010f914a
  • alt-php81-gd_8.1.34-29_amd64.deb
    sha:477414d45f2d097485ca6d48781d6d570c00033f
  • alt-php81-imap_8.1.34-29_amd64.deb
    sha:1628eb0d53c4d99a2b4e02199dbed6e7a1184fb8
  • alt-php81-intl_8.1.34-29_amd64.deb
    sha:47e3ca0588c451b63f557654fb1bbb3ab3f6487f
  • alt-php81-ldap_8.1.34-29_amd64.deb
    sha:43ebcb35551808b61ee2c626ad7f0fe4f269e561
  • alt-php81-mbstring_8.1.34-29_amd64.deb
    sha:670b47426f8185b9f24d6643b19004b19959039e
  • alt-php81-mysqlnd_8.1.34-29_amd64.deb
    sha:098a9caf4b207576b8961758004ed58f574ad766
  • alt-php81-odbc_8.1.34-29_amd64.deb
    sha:8c64ee50cbd0b943a9a9c295869fc3f9c60296b7
  • alt-php81-opcache_8.1.34-29_amd64.deb
    sha:eda32bd311deac95e7e9e0de8ec00cc00c5b073b
  • alt-php81-pdo_8.1.34-29_amd64.deb
    sha:9f37ac02cf92badb8d9719db238181f5a5a9986e
  • alt-php81-pgsql_8.1.34-29_amd64.deb
    sha:10f177dca48e96a402e4dd5a4041267081ef1b89
  • alt-php81-php-fpm_8.1.34-29_amd64.deb
    sha:c187bd0d53877a2e33fdc1d412dc504b90f8e12e
  • alt-php81-process_8.1.34-29_amd64.deb
    sha:8f57e6951975a2747de1c1f2e9472dc26f8aa8c0
  • alt-php81-pspell_8.1.34-29_amd64.deb
    sha:8300fc8034cb86fe00515f61e1ceba036cfd9b82
  • alt-php81-snmp_8.1.34-29_amd64.deb
    sha:5c1a4d5627972963d6c7f12f049cb79873a77907
  • alt-php81-soap_8.1.34-29_amd64.deb
    sha:095c1216cddeb415cb79e55493218247bd59811b
  • alt-php81-sodium_8.1.34-29_amd64.deb
    sha:89541c93aabb2b01e616d2f3c0581e1f999a6bc7
  • alt-php81-tidy_8.1.34-29_amd64.deb
    sha:deda3d0572b770b0fee2eb3fdcad5551c5a08c0d
  • alt-php81-xml_8.1.34-29_amd64.deb
    sha:e0b7a831dbc5b37f0f0c03521a78c6d2e58f117f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.