[CLSA-2026:1786375704] Fix CVE(s): CVE-2026-17543, CVE-2026-7260
Type:
security
Severity:
Critical
Release date:
2026-08-10 15:28:35 UTC
Description:
* CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped values escaped by PQescapeStringConn() in an E'...' escape-string constant, but that escaper leaves backslashes untouched when standard_conforming_strings is on, so a trailing backslash escaped the doubling quote and broke out of the literal. Drop the E prefix so the plain '...' form matches what the escaper produces. * CVE-2026-7260: phar circular symlink crash. phar_get_link_source() followed symlink chains by tail recursion with no cycle or depth guard, so a tar phar holding circular links exhausted the C stack. Walk the chain iteratively with Floyd cycle detection and return NULL on a loop; also restore the '/' separator in phar_get_link_location() so the walk stays idempotent.
CVEs fixed:
Updated packages:
  • alt-php81_8.1.34-29_amd64.deb
    sha:164650be8c57543d1c006390709a8a242b727b07
  • alt-php81-bcmath_8.1.34-29_amd64.deb
    sha:fbd9077f98be363dfb6341ae0ba387d61fc16042
  • alt-php81-cli_8.1.34-29_amd64.deb
    sha:a6ba6319e29488c693aefd72a3923aa7cc3a9139
  • alt-php81-common_8.1.34-29_amd64.deb
    sha:5834b68cfa0588e77fbeca2b65c25b38b7763a6e
  • alt-php81-dba_8.1.34-29_amd64.deb
    sha:7425acd3648019063c8a218a3b1ac68b4c4d3b97
  • alt-php81-dev_8.1.34-29_amd64.deb
    sha:6293d06c4a4fc67b72dcaf232021f938194533a7
  • alt-php81-enchant_8.1.34-29_amd64.deb
    sha:be6ed17b791bef14a5e5257780ceef1fc2f34a9b
  • alt-php81-firebird_8.1.34-29_amd64.deb
    sha:2665a1a6c20b940806ff248e265948c435ad2cd2
  • alt-php81-gd_8.1.34-29_amd64.deb
    sha:341838fb81b1386a1b958a92adf3db59e936fda4
  • alt-php81-imap_8.1.34-29_amd64.deb
    sha:d0fc758e82c0bb3c6849aafba4092aed09f071cd
  • alt-php81-intl_8.1.34-29_amd64.deb
    sha:ced409c67125f4afeba6db670d11eacfda60e14e
  • alt-php81-ldap_8.1.34-29_amd64.deb
    sha:799d23229b0344a92d60f66cc2a70abbc06ed2e1
  • alt-php81-mbstring_8.1.34-29_amd64.deb
    sha:a6a745070da9dd8082f5da1d7c070caa9edeb22c
  • alt-php81-mysqlnd_8.1.34-29_amd64.deb
    sha:88a2ff139bc4953e57bbaf6e2b09c0ff7807808c
  • alt-php81-odbc_8.1.34-29_amd64.deb
    sha:aef2c05a0c7e55cdf132fa14a36afc7b3d2a8afd
  • alt-php81-opcache_8.1.34-29_amd64.deb
    sha:4f2dd1b8c5915d98e17078b923416ba3a5bcc102
  • alt-php81-pdo_8.1.34-29_amd64.deb
    sha:48282bde1412dbcd8f15d26ad96e07b36a927ad8
  • alt-php81-pgsql_8.1.34-29_amd64.deb
    sha:368ea043406263624101fcffb82b3d4dc9bf854b
  • alt-php81-php-fpm_8.1.34-29_amd64.deb
    sha:3dd4faf756160738d14b6774acddef97570c792a
  • alt-php81-process_8.1.34-29_amd64.deb
    sha:b364f8236389e07cae2325fc65fa675a6811a3a2
  • alt-php81-pspell_8.1.34-29_amd64.deb
    sha:2ab35f50d8c481c526e8565f42d36dd68598fde8
  • alt-php81-snmp_8.1.34-29_amd64.deb
    sha:bd238adbe3b7db9f3b1039ed80d28fe1fc7627a7
  • alt-php81-soap_8.1.34-29_amd64.deb
    sha:531f96d789989b2476c4446678e44c31907328e0
  • alt-php81-sodium_8.1.34-29_amd64.deb
    sha:805e249fc5ed75ccf5c27b1fe43adeee28b3127f
  • alt-php81-tidy_8.1.34-29_amd64.deb
    sha:7bbcd33f03a0e5d3b3b2dd38c5e92b29a4115588
  • alt-php81-xml_8.1.34-29_amd64.deb
    sha:e319ed3af7cef8ea8c6486b4bccda76595f6f242
  • alt-php81_8.1.34-29_arm64.deb
    sha:1f15ce08ef8385e0cdd904b1f33342153fccf4d3
  • alt-php81-bcmath_8.1.34-29_arm64.deb
    sha:3008ef4b09d8ecca9142d37eba014c5a6cc7ae0a
  • alt-php81-cli_8.1.34-29_arm64.deb
    sha:108adbd1ad8e2ec60c5280bac82459904b70ccf5
  • alt-php81-common_8.1.34-29_arm64.deb
    sha:0cca955d0142fc043011109843b24f6675d0a889
  • alt-php81-dba_8.1.34-29_arm64.deb
    sha:64bb7a0c2f558f88d83d7e0c5c2364a5607f5025
  • alt-php81-dev_8.1.34-29_arm64.deb
    sha:d78e678f4970e7ee208f459f61f8b5d86c1d2138
  • alt-php81-enchant_8.1.34-29_arm64.deb
    sha:4c37e8ec7cc84d8125f5e8b1306e44eaaa3901f3
  • alt-php81-firebird_8.1.34-29_arm64.deb
    sha:df4317165d048d92f07b3cb300ca6843fc8d65aa
  • alt-php81-gd_8.1.34-29_arm64.deb
    sha:34037920a8113440ef2c7fd8a169f554a948a28d
  • alt-php81-imap_8.1.34-29_arm64.deb
    sha:1a0974d0504752f49661cf7b9ad4fb2f838c91fa
  • alt-php81-intl_8.1.34-29_arm64.deb
    sha:fc5ff1c369fb6dfa07be196b8d76fff82d26a6da
  • alt-php81-ldap_8.1.34-29_arm64.deb
    sha:0b65888213c2c993239f2a19aec88718e443ec20
  • alt-php81-mbstring_8.1.34-29_arm64.deb
    sha:4eb92670695a44921036300b48eda38f5ffbe888
  • alt-php81-mysqlnd_8.1.34-29_arm64.deb
    sha:7dc01f392331012324d01b9795cb2eb6df736c4f
  • alt-php81-odbc_8.1.34-29_arm64.deb
    sha:4e2c4423aec0da8cc970d55e1b0d8699ad4a1633
  • alt-php81-opcache_8.1.34-29_arm64.deb
    sha:d5fe3864f83f33cbcc168bee8af8a56ceb6d8505
  • alt-php81-pdo_8.1.34-29_arm64.deb
    sha:42527259e09b140ae6bcff5bdcddf5aec69abf89
  • alt-php81-pgsql_8.1.34-29_arm64.deb
    sha:2713c9bca3be014dabbf72e593ec1eab0f3eed71
  • alt-php81-php-fpm_8.1.34-29_arm64.deb
    sha:c9ee418a2d9d4f2464556d064a9321d273b9d66d
  • alt-php81-process_8.1.34-29_arm64.deb
    sha:4210afe136069e9f71641fd58cd1eb30ea7e2418
  • alt-php81-pspell_8.1.34-29_arm64.deb
    sha:f3211bb088b8dffc68c9414dbeb5a154cf648c45
  • alt-php81-snmp_8.1.34-29_arm64.deb
    sha:d1c9c72c4d6d3e1165ab5f2e385c057ad65650cb
  • alt-php81-soap_8.1.34-29_arm64.deb
    sha:f6015d5d257013fe0c3f10e8247ce3fd2f3dcd25
  • alt-php81-sodium_8.1.34-29_arm64.deb
    sha:42f551592d81444a4e760e624db506d8844ff6fc
  • alt-php81-tidy_8.1.34-29_arm64.deb
    sha:98f2f0f41ffcfaa56af0509a5b752b10b9512947
  • alt-php81-xml_8.1.34-29_arm64.deb
    sha:93a87acf750991dd2aade4b105ea8408b5597df4
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.