[CLSA-2026:1786438735] Fix CVE(s): CVE-2026-17543, CVE-2026-7260, CVE-2026-9672
Type:
security
Severity:
Critical
Release date:
2026-08-11 08:59:08 UTC
Description:
* CVE-2026-9672: fix three defects in the bundled libgd GIF LZW decoder reachable from attacker-controlled GIF data via imagecreatefromgif(). The table reset cleared sd->table[1][0] instead of sd->table[1][i], so stale suffixes leaked between images; LWZReadByte_() kept decoding with a stale code after the LZW end code when the trailing data block count was 0; and ReadImage() left LZW_STATIC_DATA uninitialised. * CVE-2026-17543: fix SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped PQescapeStringConn() output in an E'...' literal, but PQescapeStringConn() only doubles the single quote while standard_conforming_strings is on, so a trailing backslash escaped the closing quote and broke out of the literal in pg_convert()/pg_insert()/pg_update()/pg_select()/pg_delete(). Emit a plain '...' literal instead. * CVE-2026-7260: fix unbounded recursion in phar_get_link_source() on a circular symlink chain (GHSA-vc5h-9ppw-p5f3). The self-recursion is replaced by a Floyd cycle-detection walk that returns NULL for a cycle, including the phar_get_link_location() path-separator restore the walk depends on.
CVEs fixed:
Updated packages:
  • alt-php72_7.2.34-89_amd64.deb
    sha:47f8ad216a9c6d706c63adb1c6e6db2d26116ac3
  • alt-php72-bcmath_7.2.34-89_amd64.deb
    sha:1867e22048a53f5f96e467a02e5a6e0a0e51fc09
  • alt-php72-cli_7.2.34-89_amd64.deb
    sha:eca11116123a788b42103c270c94e8a5a412e943
  • alt-php72-common_7.2.34-89_amd64.deb
    sha:3ccda7f8b015d2e99be8401b4947ed244f9aada5
  • alt-php72-dba_7.2.34-89_amd64.deb
    sha:175fd078d96e6d3dc3089b95bf791f66c03ea333
  • alt-php72-dev_7.2.34-89_amd64.deb
    sha:5c20d1951f691bb44fd0ccbe81593ba055a92060
  • alt-php72-enchant_7.2.34-89_amd64.deb
    sha:f0e1f3f4b425d613ad7a24d75306616ed24e6dc4
  • alt-php72-firebird_7.2.34-89_amd64.deb
    sha:163c094e8ace4f9ee0de14c1be16ea3eeffc13e6
  • alt-php72-gd_7.2.34-89_amd64.deb
    sha:5021b6ce1e54b76303c360ed9735dbd57036e934
  • alt-php72-imap_7.2.34-89_amd64.deb
    sha:e2db9c5b490b44b01e659723d62a2337d2853ffa
  • alt-php72-intl_7.2.34-89_amd64.deb
    sha:37a19e894beb81c8763c9a2b43e28e3217371730
  • alt-php72-ldap_7.2.34-89_amd64.deb
    sha:ace641d8525c9a15ac0d1021cbf335e477c8e163
  • alt-php72-mbstring_7.2.34-89_amd64.deb
    sha:55afac4635c110a64ecd834dbd4b78155c599331
  • alt-php72-mysqlnd_7.2.34-89_amd64.deb
    sha:2d42bc57b8ef0f4fe75d0f373e12677c349b42c1
  • alt-php72-odbc_7.2.34-89_amd64.deb
    sha:67f401940212962b13735663c29753da4a942edd
  • alt-php72-opcache_7.2.34-89_amd64.deb
    sha:9e3c881ddc79dc74ede6fb1501ae5f5a52ec8d54
  • alt-php72-pdo_7.2.34-89_amd64.deb
    sha:82b943c111a974e82bbc0964a3dc7cec90d964ce
  • alt-php72-pgsql_7.2.34-89_amd64.deb
    sha:249eb1f840a84ffc1639c6ee9e90d18a3342c6fa
  • alt-php72-php-fpm_7.2.34-89_amd64.deb
    sha:87bfa7cdbbb78fc66b02460ab473f647adf7573a
  • alt-php72-process_7.2.34-89_amd64.deb
    sha:b14118924acec6b34029da7723a5b922d15b4b8f
  • alt-php72-pspell_7.2.34-89_amd64.deb
    sha:2427637020d65258a976214ebc243fd3e304e73e
  • alt-php72-recode_7.2.34-89_amd64.deb
    sha:ab1e3002df3fa9d5fd58102f16bf3f72e35ff237
  • alt-php72-snmp_7.2.34-89_amd64.deb
    sha:91afd38ab6bd886082b6c07dce4f1c4eeb5859ec
  • alt-php72-soap_7.2.34-89_amd64.deb
    sha:76958479c2e00b6e2549bf9d409207b7d24a8f1d
  • alt-php72-sodium_7.2.34-89_amd64.deb
    sha:2d3626680b89e4cd357a5584749ab03296f79a48
  • alt-php72-tidy_7.2.34-89_amd64.deb
    sha:f007e3eab5fdc6bf20c1d69e1e4f65782e611cc6
  • alt-php72-xml_7.2.34-89_amd64.deb
    sha:3ee87c1042d1a61daacd813a6225a6c7a5b3165e
  • alt-php72-xmlrpc_7.2.34-89_amd64.deb
    sha:a787b0ec68aa39dd8a4df9d44ec9876b87698524
  • alt-php72_7.2.34-89_arm64.deb
    sha:6582a5de70462c65687510f7858463fddb767c6e
  • alt-php72-bcmath_7.2.34-89_arm64.deb
    sha:fec45ac310b419af5e6d130e8893d3fa0403c2b1
  • alt-php72-cli_7.2.34-89_arm64.deb
    sha:efff5d27e5dff6d521d9d06e0a78af7223279cdd
  • alt-php72-common_7.2.34-89_arm64.deb
    sha:8d4b2287985a165bdcd5f44f34edf2118bb9ed0b
  • alt-php72-dba_7.2.34-89_arm64.deb
    sha:e8f5170c8d4b5e317c3be744212d1fcb02f08c6f
  • alt-php72-dev_7.2.34-89_arm64.deb
    sha:933b697b9b52f8bf894a4a2e4840d36d585f6fd1
  • alt-php72-enchant_7.2.34-89_arm64.deb
    sha:b857484c7fd1a0a00a74da0de0d7ce325be1be40
  • alt-php72-firebird_7.2.34-89_arm64.deb
    sha:252c8fa7af0097042d29863c64b44048bdec9a25
  • alt-php72-gd_7.2.34-89_arm64.deb
    sha:339732bafc9072cfa53e07d9fd7deba5dedfbe7a
  • alt-php72-imap_7.2.34-89_arm64.deb
    sha:14e0b0d777298b0e3a976b4610f6b52044e204d7
  • alt-php72-intl_7.2.34-89_arm64.deb
    sha:a1e5b4bbd9ddcfd82ff0959de8c189ced9c3c3cd
  • alt-php72-ldap_7.2.34-89_arm64.deb
    sha:e4fa645c1e85519d05e50c515464f204490363e8
  • alt-php72-mbstring_7.2.34-89_arm64.deb
    sha:81c921aa2b41b7b712d572be7575e6b73a651826
  • alt-php72-mysqlnd_7.2.34-89_arm64.deb
    sha:fb354e7bcbb31aaa9a176c9388a40e1a3c8321c1
  • alt-php72-odbc_7.2.34-89_arm64.deb
    sha:7b59d1d9c64d1c8ad8e9bf8a153c53c3b573be80
  • alt-php72-opcache_7.2.34-89_arm64.deb
    sha:fa691562daa128d0945e03f4378eaf9666fc6f42
  • alt-php72-pdo_7.2.34-89_arm64.deb
    sha:5bf04c89150f31fdba90485d7e4d51b0e8e65e13
  • alt-php72-pgsql_7.2.34-89_arm64.deb
    sha:8985eb6c9b0e8c6d602fbfa5404cda15d8e9d676
  • alt-php72-php-fpm_7.2.34-89_arm64.deb
    sha:5b03540594a7ae7cea2553d8cc043e2274bbf2ad
  • alt-php72-process_7.2.34-89_arm64.deb
    sha:9c0970a5475089b794b2354b84b74b0903532438
  • alt-php72-pspell_7.2.34-89_arm64.deb
    sha:cd063854e2d3a0717584ae69e482277905cfec66
  • alt-php72-recode_7.2.34-89_arm64.deb
    sha:6860e0544082359f8fc2c7a3190020b3cf9286ef
  • alt-php72-snmp_7.2.34-89_arm64.deb
    sha:15da028f7ead564c808bbeb83c63191359ef1d10
  • alt-php72-soap_7.2.34-89_arm64.deb
    sha:a475bc015abc7b24e8ac4c0b3a849fc38a21ea4a
  • alt-php72-sodium_7.2.34-89_arm64.deb
    sha:feba7d2e3ee562e464926b86055ff9042963c999
  • alt-php72-tidy_7.2.34-89_arm64.deb
    sha:4e7cb0f8a08ef3e6156d035c0695e3ddf43dc528
  • alt-php72-xml_7.2.34-89_arm64.deb
    sha:3532e9e442fb1440c5c97f1d06a9d30924504455
  • alt-php72-xmlrpc_7.2.34-89_arm64.deb
    sha:6728df153580540142ee228913d03f82c8d84155
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.